camstack 1.2.38 → 1.2.40

package/dist/{launcher-SCKDFMNR.js → launcher-WS2IUVTL.js}

@@ -23631,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-iAwSA2_f.js
-var require_dist_iAwSA2_f = __commonJS({
-  "../system/dist/dist-iAwSA2_f.js"(exports) {
+// ../system/dist/dist-DnhGRFEn.js
+var require_dist_DnhGRFEn = __commonJS({
+  "../system/dist/dist-DnhGRFEn.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -24111,6 +24111,13 @@ var require_dist_iAwSA2_f = __commonJS({
       _readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
       /** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
       _registeredCapNames = [];
+      /**
+      * True only after `readAddonStore` actually answered. Constructor
+      * defaults look like stored config when the store is down — a forked
+      * addon that auto-starts from those defaults (cloudflare-tunnel quick
+      * mode, 2026-08-25) is not "the operator chose this".
+      */
+      settingsStoreReady = false;
       /** Default config values. Provided via constructor. */
       defaults;
       constructor(defaults) {
@@ -24516,7 +24523,9 @@ var require_dist_iAwSA2_f = __commonJS({
         ];
         let lastErr;
         for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-          return await settings.readAddonStore() ?? {};
+          const stored = await settings.readAddonStore() ?? {};
+          this.settingsStoreReady = true;
+          return stored;
         } catch (err) {
           lastErr = err;
           const msg = err instanceof Error ? err.message : String(err);
@@ -24524,6 +24533,7 @@ var require_dist_iAwSA2_f = __commonJS({
           if (attempt === delaysMs.length) break;
           await new Promise((r) => setTimeout(r, delaysMs[attempt]));
         }
+        this.settingsStoreReady = false;
         this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries \u2014 using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
         return {};
       }
@@ -26256,6 +26266,15 @@ var require_dist_iAwSA2_f = __commonJS({
       description: zod.z.string().optional(),
       icon: zod.z.string().optional()
     });
+    var ClassMapDefinitionSchema = zod.z.object({
+      mapping: zod.z.record(zod.z.string(), zod.z.enum([
+        "person",
+        "vehicle",
+        "animal",
+        "package"
+      ])),
+      preserveOriginal: zod.z.boolean()
+    });
     var MODEL_FORMATS = [
       "onnx",
       "coreml",
@@ -26309,6 +26328,12 @@ var require_dist_iAwSA2_f = __commonJS({
       */
       resolution: zod.z.number().int().positive().optional()
     });
+    var ModelProviderIdSchema = zod.z.enum([
+      "camstack",
+      "frigate",
+      "scrypted",
+      "custom"
+    ]);
     var ModelCatalogEntrySchema = zod.z.object({
       id: zod.z.string(),
       name: zod.z.string(),
@@ -26404,7 +26429,19 @@ var require_dist_iAwSA2_f = __commonJS({
       * `id` stays the source of truth for resolution/download/persistence; grouping
       * is a presentation overlay resolved back to an `id`.
       */
-      group: ModelVariantGroupSchema.optional()
+      group: ModelVariantGroupSchema.optional(),
+      /**
+      * Catalog source for the pipeline stepper's provider-first picker. Absent on
+      * built-in CamStack entries (treated as `camstack`) and on registry rows
+      * persisted before this field existed (`inferModelProvider` fills those).
+      */
+      provider: ModelProviderIdSchema.optional(),
+      /**
+      * Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+      * applies (Frigate / COCO public catalog). Set on a custom model whose raw
+      * labels already ARE the CamStack macros (Scrypted identity map).
+      */
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
       format: zod.z.literal("openvino"),
@@ -26433,7 +26470,8 @@ var require_dist_iAwSA2_f = __commonJS({
         "ocr",
         "segmentation"
       ]),
-      faceAlignment: zod.z.boolean().optional()
+      faceAlignment: zod.z.boolean().optional(),
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertArtifactSchema = zod.z.object({
       format: zod.z.enum(MODEL_FORMATS),
@@ -33167,14 +33205,22 @@ var require_dist_iAwSA2_f = __commonJS({
       sustainSeconds: zod.z.number().int().min(0).max(3600).default(15)
     });
     var NcAudioConditionSchema = zod.z.object({
-      /** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+      /** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
       labels: zod.z.array(zod.z.string().min(1)).min(1).optional(),
       /** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
       dbThreshold: zod.z.number().min(-96).max(0).optional(),
       /** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
       hitPercent: zod.z.number().int().min(1).max(100).default(60),
       /** LEVEL MODE ONLY: length of the sampling window in seconds. */
-      samplingSeconds: zod.z.number().int().min(1).max(300).default(10)
+      samplingSeconds: zod.z.number().int().min(1).max(300).default(10),
+      /**
+      * LABEL MODE: how many labelled frames must land inside
+      * {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+      * Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+      */
+      confirmHits: zod.z.number().int().min(1).max(20).optional(),
+      /** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+      confirmWindowSec: zod.z.number().int().min(1).max(60).optional()
     });
     var NcCrossingSchema = zod.z.enum([
       "enter",
@@ -34992,6 +35038,46 @@ var require_dist_iAwSA2_f = __commonJS({
       /** Cursor for the next page, or null when this page is the last. */
       nextCursor: zod.z.string().nullable()
     });
+    var LIST_GROUPS_DEFAULT_LIMIT = 40;
+    var LIST_GROUPS_MAX_LIMIT = 100;
+    var AnalyticsGroupRecordSchema = zod.z.object({
+      id: zod.z.string(),
+      deviceId: zod.z.number().int(),
+      openedAt: zod.z.number().int(),
+      closedAt: zod.z.number().int(),
+      timestamp: zod.z.number().int(),
+      memberCount: zod.z.number().int(),
+      memberTrackIds: zod.z.array(zod.z.string()).readonly(),
+      className: zod.z.string(),
+      classes: zod.z.array(zod.z.string()).readonly(),
+      /** Relative event-media path, or null when the group has no picture yet. */
+      mediaUrl: zod.z.string().nullable(),
+      singleton: zod.z.boolean()
+    });
+    var AnalyticsGroupMemberSchema = zod.z.object({
+      trackId: zod.z.string(),
+      deviceId: zod.z.number().int(),
+      className: zod.z.string(),
+      firstSeen: zod.z.number().int(),
+      lastSeen: zod.z.number().int(),
+      mediaUrl: zod.z.string().nullable()
+    });
+    var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: zod.z.array(AnalyticsGroupMemberSchema).readonly() });
+    var ListGroupsQueryInput = zod.z.object({
+      /** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+      deviceIds: zod.z.array(zod.z.number()),
+      /** Window lower bound on `closedAt` (inclusive). */
+      since: zod.z.number().optional(),
+      /** Window upper bound on `openedAt` (inclusive). */
+      until: zod.z.number().optional(),
+      limit: zod.z.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+      /** Opaque continuation cursor from a previous page's `nextCursor`. */
+      cursor: zod.z.string().optional()
+    });
+    var ListGroupsPageSchema = zod.z.object({
+      groups: zod.z.array(AnalyticsGroupRecordSchema).readonly(),
+      nextCursor: zod.z.string().nullable()
+    });
     var KeyEventQueryInput = zod.z.object({
       deviceId: zod.z.number(),
       /** Window lower bound (track firstSeen ≥ since). */
@@ -35067,7 +35153,9 @@ var require_dist_iAwSA2_f = __commonJS({
       /** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
       plates: zod.z.number().int(),
       /** Per-track CLIP search vectors removed (best-effort). */
-      embeddings: zod.z.number().int()
+      embeddings: zod.z.number().int(),
+      /** Group membership + group rows removed with their last member (best-effort). */
+      groups: zod.z.number().int()
     });
     var DiskReconcileCountsSchema = zod.z.object({
       mediaDropped: zod.z.number().int(),
@@ -35209,6 +35297,16 @@ var require_dist_iAwSA2_f = __commonJS({
         * are not included (same contract as `listTracks`).
         */
         listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
+        /**
+        * Batched co-moving group listing — the Groups feed. Same merge/cursor
+        * contract as {@link listRecentTracks}. A group is a sealed partition of
+        * one session; `getGroup` is the detail with members.
+        */
+        listGroups: method(ListGroupsQueryInput, ListGroupsPageSchema),
+        getGroup: method(zod.z.object({
+          deviceId: zod.z.number(),
+          groupId: zod.z.string().min(1)
+        }), AnalyticsGroupDetailSchema.nullable()),
         clearTracks: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
           auth: "admin"
@@ -35797,6 +35895,33 @@ var require_dist_iAwSA2_f = __commonJS({
         h: zod.z.number()
       })
     });
+    zod.z.object({
+      crop: zod.z.object({
+        left: zod.z.number(),
+        top: zod.z.number(),
+        width: zod.z.number().positive(),
+        height: zod.z.number().positive()
+      }).optional(),
+      content: zod.z.object({
+        width: zod.z.number().int().positive(),
+        height: zod.z.number().int().positive()
+      }),
+      fit: zod.z.enum(["stretch", "contain"]),
+      format: zod.z.enum([
+        "rgb",
+        "gray",
+        "jpeg"
+      ])
+    });
+    var FrameRefSchema = zod.z.object({
+      registryId: zod.z.string().min(1),
+      id: zod.z.string().min(1),
+      width: zod.z.number().int().positive(),
+      height: zod.z.number().int().positive(),
+      format: zod.z.enum(["rgb", "gray"]),
+      timestamp: zod.z.number(),
+      capturedAt: zod.z.number().optional()
+    });
     var ModelFormatSchema$1 = zod.z.enum([
       "onnx",
       "coreml",
@@ -35863,7 +35988,8 @@ var require_dist_iAwSA2_f = __commonJS({
         sizeMB: zod.z.number()
       })),
       group: ModelVariantGroupSchema.optional(),
-      legacy: zod.z.boolean().optional()
+      legacy: zod.z.boolean().optional(),
+      provider: ModelProviderIdSchema.optional()
     });
     var ConfigFieldBridge = zod.z.custom();
     var PipelineAddonSchemaSchema = zod.z.object({
@@ -36096,7 +36222,7 @@ var require_dist_iAwSA2_f = __commonJS({
         * legacy call shape used by existing benchmark code; once all
         * callers pass it explicitly we make it required.
         *
-        * Exactly one of `frame`, `frameHandle`, `imageBase64`,
+        * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
         * `referenceImage` must be provided:
         *  - `frame`: runtime dispatch path (runner → decoded broker frame).
         *    Carries the raw buffer, dimensions, and format; the executor
@@ -36118,6 +36244,12 @@ var require_dist_iAwSA2_f = __commonJS({
           steps: zod.z.array(PipelineStepInputSchema).min(1),
           frame: FrameInputSchema.optional(),
           /**
+          * Process-local lazy frame. Valid only when caller and provider resolve
+          * in the same execution-group process; split/cross-node callers use
+          * `frame`/`image` inline compatibility instead.
+          */
+          frameRef: FrameRefSchema.optional(),
+          /**
           * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
           * the decoded pixels live in. One more member of the one-of
           * frame/frameHandle/image/imageBase64/referenceImage group.
@@ -36420,7 +36552,10 @@ var require_dist_iAwSA2_f = __commonJS({
       * Which source served this crop, so a quality-sensitive consumer (the native
       * `keyFrame`) can reject a degraded fallback:
       * - `native` — cut from the decode worker's retained NATIVE surface (the
-      *   quality path).
+      *   quality path). A subject-tile serve is also native-resolution and stays
+      *   `native` here: the public enum cannot name `tile` without a breaking cap
+      *   change. Runner telemetry distinguishes lease vs tile via `source` on the
+      *   internal crop result (`nativeHits` vs `tileHits`).
       * - `ram-fullframe` — the native surface MISSED but the request was full-frame,
       *   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
       *   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -36780,12 +36915,41 @@ var require_dist_iAwSA2_f = __commonJS({
         cpuCores: zod.z.number().optional()
       })
     });
+    var FrameLazyCountersSchema = zod.z.object({
+      framesDecoded: zod.z.number(),
+      framesAdmitted: zod.z.number(),
+      framesDroppedPixelFree: zod.z.number(),
+      viewsMaterialized: zod.z.number(),
+      viewsSkipped: zod.z.number(),
+      workerToRunnerBytes: zod.z.number(),
+      runnerToPoolRawBytes: zod.z.number(),
+      runnerToPoolJpegBytes: zod.z.number(),
+      onDemandFullFrameRequests: zod.z.number(),
+      onDemandCropRequests: zod.z.number(),
+      nativeHits: zod.z.number(),
+      nativeMisses: zod.z.number(),
+      tileHits: zod.z.number(),
+      tileMisses: zod.z.number(),
+      fallbackHits: zod.z.number(),
+      fallbackMisses: zod.z.number(),
+      retainedWritesAvoided: zod.z.number(),
+      residentRefs: zod.z.number(),
+      residentBytes: zod.z.number(),
+      releases: zod.z.number(),
+      evictions: zod.z.number(),
+      staleMisses: zod.z.number()
+    });
+    var FrameLazyMetricsSchema = zod.z.object({
+      node: FrameLazyCountersSchema,
+      cameras: zod.z.array(FrameLazyCountersSchema.extend({ deviceId: zod.z.number() }))
+    });
     var RunnerLocalMetricsSchema = zod.z.object({
       nodeId: zod.z.string(),
       activeCameras: zod.z.number(),
       throttledCameras: zod.z.number(),
       avgInferenceTimeMs: zod.z.number(),
-      queueDepth: zod.z.number()
+      queueDepth: zod.z.number(),
+      frameLazy: FrameLazyMetricsSchema.optional()
     });
     var pipelineRunnerCapability = {
       name: "pipeline-runner",
@@ -38570,6 +38734,8 @@ var require_dist_iAwSA2_f = __commonJS({
         endDownload: method(EndDownloadInputSchema, zod.z.void(), { kind: "mutation" })
       }
     };
+    var ProfileSettingsSchemaBridge = zod.z.unknown().nullable();
+    var ProfileSettingsBagSchema = zod.z.record(zod.z.string(), zod.z.unknown());
     var TerminalSessionInfoSchema = zod.z.object({
       /** Opaque session id minted by the provider on `openSession`. */
       sessionId: zod.z.string(),
@@ -38585,7 +38751,14 @@ var require_dist_iAwSA2_f = __commonJS({
     var TerminalProfileInfoSchema = zod.z.object({
       profileId: zod.z.string(),
       label: zod.z.string(),
-      description: zod.z.string().optional()
+      description: zod.z.string().optional(),
+      /** Spawn defaults the instance form copies on create. */
+      executable: zod.z.string().optional(),
+      args: zod.z.array(zod.z.string()).readonly().optional(),
+      cwd: zod.z.string().optional(),
+      environment: zod.z.array(zod.z.string()).readonly().optional(),
+      /** ConfigUISchema for instance knobs, or null when the profile has none. */
+      settingsSchema: ProfileSettingsSchemaBridge.optional()
     });
     var TerminalInstanceInfoSchema = zod.z.object({
       instanceId: zod.z.string(),
@@ -38594,7 +38767,12 @@ var require_dist_iAwSA2_f = __commonJS({
       profileId: zod.z.string(),
       profileLabel: zod.z.string(),
       name: zod.z.string(),
-      enabled: zod.z.boolean()
+      enabled: zod.z.boolean(),
+      executable: zod.z.string(),
+      args: zod.z.array(zod.z.string()).readonly(),
+      cwd: zod.z.string(),
+      environment: zod.z.array(zod.z.string()).readonly(),
+      profileSettings: ProfileSettingsBagSchema
     });
     var TerminalLegacyCameraSchema = zod.z.object({
       stableId: zod.z.string(),
@@ -38633,7 +38811,24 @@ var require_dist_iAwSA2_f = __commonJS({
         createInstance: method(zod.z.object({
           targetNodeId: zod.z.string().min(1),
           profileId: zod.z.string().min(1),
-          name: zod.z.string().trim().min(1).max(160).optional()
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
+        }), TerminalInstanceInfoSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        updateInstance: method(zod.z.object({
+          instanceId: zod.z.string().min(1),
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
         }), TerminalInstanceInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -38668,7 +38863,11 @@ var require_dist_iAwSA2_f = __commonJS({
         openSession: method(zod.z.object({
           profileId: zod.z.string(),
           cols: zod.z.number().int().positive(),
-          rows: zod.z.number().int().positive()
+          rows: zod.z.number().int().positive(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
         }), TerminalSessionInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -42391,6 +42590,12 @@ var require_dist_iAwSA2_f = __commonJS({
       /** What the ranking currently resolves to (null when nothing is reachable). */
       resolved: zod.z.string().nullable()
     });
+    var ViewerEndpointsSchema = zod.z.object({
+      /** The operator's explicit race set, or empty for AUTO. */
+      baseUrls: zod.z.array(zod.z.string()).readonly(),
+      /** What the ranking currently resolves to (may be empty if nothing is up). */
+      resolved: zod.z.array(zod.z.string()).readonly()
+    });
     var AllowedAddressesSchema = zod.z.object({
       /**
       * Allowlist of interface addresses operators have explicitly opted
@@ -42400,6 +42605,20 @@ var require_dist_iAwSA2_f = __commonJS({
       */
       addresses: zod.z.array(zod.z.string()).readonly()
     });
+    var TlsStatusSchema = zod.z.object({
+      mode: zod.z.enum([
+        "generated",
+        "uploaded",
+        "disabled"
+      ]),
+      leafFingerprintSha256: zod.z.string().nullable(),
+      caFingerprintSha256: zod.z.string().nullable(),
+      validTo: zod.z.string().nullable(),
+      sans: zod.z.array(zod.z.string()),
+      caCertPem: zod.z.string().nullable(),
+      reissueError: zod.z.string().nullable(),
+      restartRequired: zod.z.boolean()
+    });
     var localNetworkCapability = {
       name: "local-network",
       scope: "system",
@@ -42419,13 +42638,13 @@ var require_dist_iAwSA2_f = __commonJS({
         */
         getPreferred: method(zod.z.void(), PreferredSchema),
         /**
-        * Ordered candidate base URLs the SDK should try on connect.
-        * Includes LAN IPs (one per non-internal interface), the public
-        * tunnel hostname (when active), and loopback as a last-resort
-        * fallback. Filterable by `includeLoopback` / `ipv4Only`.
-        * Honours `getAllowedAddresses()` when set — addresses outside
-        * the allowlist are dropped (the public tunnel + loopback are
-        * always included as escape hatches).
+        * Ordered candidate base URLs (the palette the Network tab shows).
+        * Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+        * joined. Loopback is off by default. The SDK races the subset from
+        * `getViewerEndpoints`, not this full list — IPv6 stays here because
+        * WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+        * `getAllowedAddresses()` when set — addresses outside the allowlist
+        * are dropped (the public tunnel is still included as an escape hatch).
         *
         * **The port is the hub's, not the caller's** (D62 — a function's fact
         * belongs to whoever already owns it). This method used to take a `port`
@@ -42456,10 +42675,11 @@ var require_dist_iAwSA2_f = __commonJS({
           */
           port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-          *  candidate. Default `true`. */
+          *  candidate. Default `false` — loopback is not a client route. */
           includeLoopback: zod.z.boolean().optional(),
-          /** Skip IPv6 entries. Some legacy clients can't parse them.
-          *  Default `false`. */
+          /** Skip IPv6 entries. Default `false` — the palette includes stable
+          *  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+          *  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
           ipv4Only: zod.z.boolean().optional(),
           /** Scheme to emit for LAN/loopback URLs. Default `'http'`.
           *  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -42488,6 +42708,19 @@ var require_dist_iAwSA2_f = __commonJS({
         */
         setNotificationEndpoint: method(zod.z.object({ baseUrl: zod.z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
         /**
+        * The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+        * means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+        * never mesh, never loopback. `resolved` is that set (or the operator's
+        * explicit subset) as it stands right now.
+        */
+        getViewerEndpoints: method(zod.z.void(), ViewerEndpointsSchema),
+        /**
+        * Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+        * verbatim (not indices) so a temporarily-down tunnel is not silently
+        * dropped from the operator's choice.
+        */
+        setViewerEndpoints: method(zod.z.object({ baseUrls: zod.z.array(zod.z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+        /**
         * Read the operator's allowlist. Empty = "auto" (no filter). Used
         * by the admin UI's address selector to seed its checkbox state.
         */
@@ -42505,7 +42738,34 @@ var require_dist_iAwSA2_f = __commonJS({
         * when the operator wants to wipe their manual edits and start
         * over from the auto-detected best matches.
         */
-        resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" })
+        resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+        /**
+        * Live TLS material for the Network → Local access certificate card.
+        * LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+        * a second store — this query is status, not configuration.
+        */
+        getTlsStatus: method(zod.z.void(), TlsStatusSchema),
+        /** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+        regenerateCertificate: method(zod.z.object({ reason: zod.z.string().optional() }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** Replace the served material with operator-supplied PEMs. */
+        uploadCertificate: method(zod.z.object({
+          certPem: zod.z.string().min(1),
+          keyPem: zod.z.string().min(1),
+          caPem: zod.z.string().optional()
+        }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** The local CA PEM, or empty when there is none to download. */
+        downloadCa: method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
+        /** Drop uploaded material and return to the generated local CA. */
+        revertToGeneratedCertificate: method(zod.z.void(), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        })
       },
       /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
       mount: { kind: "hub-only" }
@@ -44038,7 +44298,12 @@ var require_dist_iAwSA2_f = __commonJS({
       plateBbox: BoundingBoxSchema.optional(),
       /** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
       keyFrameMediaKey: zod.z.string().optional(),
-      base64: zod.z.string().optional()
+      base64: zod.z.string().optional(),
+      /**
+      * Same crop as a data-plane URL. `getPlateByTrack` returns this and
+      * never inlines JPEG; `listPlates` still inlines for the admin-ui.
+      */
+      cropUrl: zod.z.string().optional()
     });
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
@@ -49869,6 +50134,12 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "create"
       },
+      "localNetwork.downloadCa": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.getAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -49893,18 +50164,42 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "view"
       },
+      "localNetwork.getTlsStatus": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
+      "localNetwork.getViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.list": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "localNetwork.regenerateCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.resetAllowlistToBestMatch": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "delete"
       },
+      "localNetwork.revertToGeneratedCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.setAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -49917,6 +50212,18 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "create"
       },
+      "localNetwork.setViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "localNetwork.uploadCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "lockControl.lock": {
         capName: "lock-control",
         capScope: "device",
@@ -50715,6 +51022,12 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getGroup": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getKeyEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -50799,6 +51112,12 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listGroups": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listOpsLog": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -52797,6 +53116,12 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "create"
       },
+      "terminalSession.updateInstance": {
+        capName: "terminal-session",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "terminalSession.writeInput": {
         capName: "terminal-session",
         capScope: "system",
@@ -54212,6 +54537,11 @@ var require_dist_iAwSA2_f = __commonJS({
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getGroup": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.getKeyEvents": [{
         name: "deviceId",
         form: "single",
@@ -54267,6 +54597,11 @@ var require_dist_iAwSA2_f = __commonJS({
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listGroups": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "pipelineAnalytics.listOpsLog": [{
         name: "deviceId",
         form: "single",
@@ -55425,6 +55760,35 @@ var require_dist_iAwSA2_f = __commonJS({
       }]
     }].map((s) => [s.stepId, s.defaultModelId])));
     zod.z.string().min(1);
+    var CLUSTER_STEP_SETTING_FIELDS = [{
+      stepId: "face-embedding",
+      key: "minLandmarkFaceSize",
+      label: "Min face size for recognition (detection px)",
+      description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node \u2014 the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+      type: "slider",
+      min: 0,
+      max: 64,
+      step: 2,
+      default: 24
+    }];
+    function clusterStepSettingKey(stepId, fieldKey) {
+      return `clusterStepSetting:${stepId}:${fieldKey}`;
+    }
+    var ClusterSettingNumberSchema = zod.z.number().finite();
+    function readClusterStepSettings(config) {
+      const out = {};
+      for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+        const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+        const value = parsed.success ? parsed.data : field.default;
+        const existing = out[field.stepId] ?? {};
+        out[field.stepId] = {
+          ...existing,
+          [field.key]: value
+        };
+      }
+      return out;
+    }
+    readClusterStepSettings({});
     zod.z.object({
       /**
       * Fraction of the box's own size added on EACH side before cutting.
@@ -56256,7 +56620,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -57075,7 +57439,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -57169,7 +57533,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -58066,11 +58430,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-OfhqQio4.js
-var require_retired_settings_keys_OfhqQio4 = __commonJS({
-  "../system/dist/retired-settings-keys-OfhqQio4.js"(exports) {
+// ../system/dist/retired-settings-keys-D6Jy_SsO.js
+var require_retired_settings_keys_D6Jy_SsO = __commonJS({
+  "../system/dist/retired-settings-keys-D6Jy_SsO.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -60113,8 +60477,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
-    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
+    var require_dist10 = require_dist_DnhGRFEn();
+    var require_retired_settings_keys = require_retired_settings_keys_D6Jy_SsO();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -64441,7 +64805,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -64578,7 +64942,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -64768,7 +65132,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -72452,7 +72816,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -73017,7 +73381,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -73959,7 +74323,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -75075,8 +75439,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
-    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
+    var require_dist10 = require_dist_DnhGRFEn();
+    var require_retired_settings_keys = require_retired_settings_keys_D6Jy_SsO();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -76420,6 +76784,17 @@ var require_sqlite_settings_addon = __commonJS({
       constructor() {
         super({});
       }
+      /**
+      * The engine behind `settings-store` cannot read that door during
+      * `initialize()`. `BaseAddon` always `await`s `resolveConfig()` first;
+      * on an isolated sqlite that round-trip is a UDS call to the parent,
+      * and the parent is waiting for THIS child's post-init handshake before
+      * it builds the door (D233). Live 1.2.152: 30 s hang, timeout, every
+      * in-process builtin skipped, then this addon finished one second later.
+      * Constructor defaults (`{}`) are the whole config this addon has.
+      */
+      async resolveConfig() {
+      }
       async onInitialize() {
         const addonId = require_dist10.bareAddonId(this.ctx.id);
         const path = await import("path");
@@ -76535,6 +76910,7 @@ var require_sqlite_settings_addon = __commonJS({
     exports.WAL_IDLE_QUIET_MS = WAL_IDLE_QUIET_MS;
     exports.WAL_MAINTENANCE_INTERVAL_MS = WAL_MAINTENANCE_INTERVAL_MS;
     exports.WalMaintenance = WalMaintenance;
+    exports.prefixRange = prefixRange;
   }
 });
 
@@ -76620,7 +76996,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -78499,7 +78875,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -96560,7 +96936,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -96697,9 +97073,9 @@ var require_winston_logging = __commonJS({
   }
 });
 
-// ../system/dist/file-data-plane-DUHPHa-Y.js
-var require_file_data_plane_DUHPHa_Y = __commonJS({
-  "../system/dist/file-data-plane-DUHPHa-Y.js"(exports) {
+// ../system/dist/file-data-plane-DO8KbxCe.js
+var require_file_data_plane_DO8KbxCe = __commonJS({
+  "../system/dist/file-data-plane-DO8KbxCe.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -96732,15 +97108,56 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
       if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
       return headers;
     }
-    async function downloadFile(url, destPath, onProgress) {
+    var DEFAULT_MAX_REDIRECTS = 5;
+    function normalizeDownloadOptions(third) {
+      if (typeof third === "function") return { onProgress: third };
+      return third ?? {};
+    }
+    function isRedirectStatus(status) {
+      return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+    }
+    function resolveRedirectUrl(current, location) {
+      return new URL(location, current);
+    }
+    async function downloadFile(url, destPath, onProgressOrOptions) {
       if (node_fs.existsSync(destPath)) return destPath;
+      const opts = normalizeDownloadOptions(onProgressOrOptions);
+      const fetchImpl = opts.fetchImpl ?? fetch;
+      const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
       node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
       const tmpPath = destPath + ".downloading";
       try {
-        const response = await fetch(url, {
-          redirect: "follow",
-          headers: buildHeaders(url)
-        });
+        let current = url;
+        const seen = /* @__PURE__ */ new Set();
+        let response;
+        const manual = opts.redirectPolicy !== void 0;
+        for (let hop = 0; hop <= maxRedirects; hop++) {
+          const parsed = new URL(current);
+          if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+          if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+          seen.add(parsed.href);
+          const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+          const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+          try {
+            response = await fetchImpl(current, {
+              redirect: manual ? "manual" : "follow",
+              headers: buildHeaders(current),
+              ...controller ? { signal: controller.signal } : {}
+            });
+          } finally {
+            if (timer) clearTimeout(timer);
+          }
+          if (manual && isRedirectStatus(response.status)) {
+            const location = response.headers.get("location");
+            if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+            if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+            current = resolveRedirectUrl(current, location).href;
+            continue;
+          }
+          break;
+        }
+        if (!response) throw new Error(`No response downloading ${url}`);
+        if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
         if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
         if (!response.body) throw new Error(`No response body from ${url}`);
         const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -96751,9 +97168,10 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
           for (; ; ) {
             const { done, value } = await reader.read();
             if (done || !value) break;
-            fileStream.write(value);
             downloaded += value.length;
-            onProgress?.(downloaded, total);
+            if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+            fileStream.write(value);
+            opts.onProgress?.(downloaded, total);
           }
         } finally {
           fileStream.end();
@@ -97715,9 +98133,9 @@ var require_event_category_EY0GNjV9 = __commonJS({
   }
 });
 
-// ../types/dist/sleep-C2XhJhkd.js
-var require_sleep_C2XhJhkd = __commonJS({
-  "../types/dist/sleep-C2XhJhkd.js"(exports) {
+// ../types/dist/sleep-CizGYrCD.js
+var require_sleep_CizGYrCD = __commonJS({
+  "../types/dist/sleep-CizGYrCD.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_EY0GNjV9();
     var zod = require_zod();
@@ -98088,6 +98506,13 @@ var require_sleep_C2XhJhkd = __commonJS({
       _readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
       /** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
       _registeredCapNames = [];
+      /**
+      * True only after `readAddonStore` actually answered. Constructor
+      * defaults look like stored config when the store is down — a forked
+      * addon that auto-starts from those defaults (cloudflare-tunnel quick
+      * mode, 2026-08-25) is not "the operator chose this".
+      */
+      settingsStoreReady = false;
       /** Default config values. Provided via constructor. */
       defaults;
       constructor(defaults) {
@@ -98493,7 +98918,9 @@ var require_sleep_C2XhJhkd = __commonJS({
         ];
         let lastErr;
         for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-          return await settings.readAddonStore() ?? {};
+          const stored = await settings.readAddonStore() ?? {};
+          this.settingsStoreReady = true;
+          return stored;
         } catch (err) {
           lastErr = err;
           const msg = err instanceof Error ? err.message : String(err);
@@ -98501,6 +98928,7 @@ var require_sleep_C2XhJhkd = __commonJS({
           if (attempt === delaysMs.length) break;
           await new Promise((r) => setTimeout(r, delaysMs[attempt]));
         }
+        this.settingsStoreReady = false;
         this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries \u2014 using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
         return {};
       }
@@ -99759,6 +100187,73 @@ var require_sleep_C2XhJhkd = __commonJS({
         }
       };
     }
+    function createEventBusSliceSource(deps) {
+      const { eventBus, api } = deps;
+      const cache2 = /* @__PURE__ */ new Map();
+      const listeners = /* @__PURE__ */ new Map();
+      let offBus = null;
+      const keyOf = (deviceId, capName) => `${deviceId}:${capName}`;
+      const fanOut = (deviceId, capName, slice) => {
+        const k = keyOf(deviceId, capName);
+        cache2.set(k, slice);
+        const set = listeners.get(k);
+        if (!set) return;
+        for (const cb of set) try {
+          cb(slice);
+        } catch {
+        }
+      };
+      const ensureBridge = () => {
+        if (offBus) return;
+        offBus = eventBus.subscribe({ category: DEVICE_STATE_EVENT_CATEGORY }, (event2) => {
+          const data = event2.data;
+          if (typeof data !== "object" || data === null) return;
+          const deviceId = Reflect.get(data, "deviceId");
+          const capName = Reflect.get(data, "capName");
+          if (typeof deviceId !== "number" || typeof capName !== "string") return;
+          fanOut(deviceId, capName, Reflect.get(data, "slice"));
+        });
+      };
+      const closeBridgeIfIdle = () => {
+        if (offBus === null) return;
+        if (listeners.size > 0) return;
+        offBus();
+        offBus = null;
+      };
+      return {
+        read(deviceId, capName) {
+          return cache2.get(keyOf(deviceId, capName));
+        },
+        async refresh(deviceId, capName) {
+          fanOut(deviceId, capName, await api.deviceState.getCapSlice.query({
+            deviceId,
+            capName
+          }) ?? void 0);
+        },
+        watch(deviceId, capName, cb) {
+          const k = keyOf(deviceId, capName);
+          let set = listeners.get(k);
+          if (!set) {
+            set = /* @__PURE__ */ new Set();
+            listeners.set(k, set);
+          }
+          set.add(cb);
+          ensureBridge();
+          return () => {
+            set.delete(cb);
+            if (set.size === 0) listeners.delete(k);
+            closeBridgeIfIdle();
+          };
+        },
+        async write(deviceId, capName, slice) {
+          await api.deviceState.setCapSlice.mutate({
+            deviceId,
+            capName,
+            slice
+          });
+        }
+      };
+    }
     function createMirrorSource(mirror, listeners, api) {
       const keyOf = (deviceId, capName) => `${deviceId}:${capName}`;
       return {
@@ -100178,6 +100673,8 @@ var require_sleep_C2XhJhkd = __commonJS({
           getTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrack", "query", input),
           listTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTracks", "query", input),
           listRecentTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRecentTracks", "query", input),
+          listGroups: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listGroups", "query", input),
+          getGroup: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getGroup", "query", input),
           clearTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "clearTracks", "mutation", input),
           getMotionEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getMotionEvents", "query", input),
           getObjectEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getObjectEvents", "query", input),
@@ -100956,6 +101453,12 @@ var require_sleep_C2XhJhkd = __commonJS({
         return createEvent;
       }
     });
+    Object.defineProperty(exports, "createEventBusSliceSource", {
+      enumerable: true,
+      get: function() {
+        return createEventBusSliceSource;
+      }
+    });
     Object.defineProperty(exports, "createLazyTrpcSource", {
       enumerable: true,
       get: function() {
@@ -101157,7 +101660,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_EY0GNjV9();
-    var require_sleep = require_sleep_C2XhJhkd();
+    var require_sleep = require_sleep_CizGYrCD();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -101270,6 +101773,7 @@ var require_addon = __commonJS({
         "getMotionEvents": { "limit": 1e3 },
         "getObjectEvents": { "limit": 1e3 },
         "getSensorEvents": { "limit": 1e3 },
+        "listGroups": { "limit": 40 },
         "listRecentTracks": { "limit": 200 },
         "searchObjectEvents": {
           "limit": 50,
@@ -101477,6 +101981,7 @@ var require_addon = __commonJS({
     exports.asJsonObject = require_sleep.asJsonObject;
     exports.asString = require_sleep.asString;
     exports.createDeviceProxy = require_sleep.createDeviceProxy;
+    exports.createEventBusSliceSource = require_sleep.createEventBusSliceSource;
     exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
     exports.emitReadiness = require_sleep.emitReadiness;
     exports.errMsg = require_err_msg.errMsg;
@@ -108031,9 +108536,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-CwBbX4Ut.js
-var require_manifest_python_deps_CwBbX4Ut = __commonJS({
-  "../system/dist/manifest-python-deps-CwBbX4Ut.js"(exports) {
+// ../system/dist/manifest-python-deps-B3_4YiDK.js
+var require_manifest_python_deps_B3_4YiDK = __commonJS({
+  "../system/dist/manifest-python-deps-B3_4YiDK.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -108049,6 +108554,7 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
     var node_http = __require("http");
+    var node_perf_hooks = __require("perf_hooks");
     var node_v8 = __require("v8");
     node_v8 = require_chunk.__toESM(node_v8);
     var node_vm = __require("vm");
@@ -108066,6 +108572,41 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
     }
     var HEAP_RECLAIM_TRIGGER_MB = 1024;
     var HEAP_RECLAIM_MIN_INTERVAL_MS = 12e4;
+    var ZERO_LOOP_DELAY = {
+      p50Ms: 0,
+      p99Ms: 0,
+      maxMs: 0
+    };
+    function createLoopDelayMeter(resolutionMs = 20) {
+      try {
+        const histogram = (0, node_perf_hooks.monitorEventLoopDelay)({ resolution: resolutionMs });
+        histogram.enable();
+        return {
+          read: () => {
+            try {
+              if (histogram.count === 0) return ZERO_LOOP_DELAY;
+              const sample = {
+                p50Ms: Math.round(histogram.percentile(50) / 1e6),
+                p99Ms: Math.round(histogram.percentile(99) / 1e6),
+                maxMs: Math.round(histogram.max / 1e6)
+              };
+              histogram.reset();
+              return sample;
+            } catch {
+              return ZERO_LOOP_DELAY;
+            }
+          },
+          stop: () => {
+            histogram.disable();
+          }
+        };
+      } catch {
+        return;
+      }
+    }
+    function heapCeilingOrigin(execArgv = process.execArgv) {
+      return execArgv.some((arg) => /^--max[-_]old[-_]space[-_]size(=|$)/.test(arg)) ? "explicit" : "v8-default";
+    }
     var MB = (bytes) => Math.round(bytes / 1048576);
     function buildHeapSample(mem, heapLimitBytes, warnRatio = HEAP_WATCH_WARN_RATIO) {
       const usedRatio = heapLimitBytes > 0 ? mem.heapUsed / heapLimitBytes : 0;
@@ -108107,10 +108648,12 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
         return;
       }
     }
-    function format2(label, s) {
-      return `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+    function format2(label, s, loop) {
+      const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+      if (loop === void 0) return line;
+      return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms`;
     }
-    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions) {
+    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv) {
       const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
       const now = reclaimOptions?.now ?? (() => Date.now());
       const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -108119,14 +108662,22 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
       const escalateRatio = reclaimOptions?.escalateRatio ?? 0.7;
       const deescalateRatio = reclaimOptions?.deescalateRatio ?? 0.6;
       let lastReclaimAt = Number.NEGATIVE_INFINITY;
+      let passesAtFloor = 0;
+      let steadyStateAnnounced = false;
       const read = () => {
         const limit = reclaimOptions?.heapLimitBytes ?? node_v8.getHeapStatistics().heap_size_limit;
         return buildHeapSample(readMemory(), limit);
       };
       const maybeReclaim = (sample) => {
         if (reclaimOptions === void 0) return;
-        if (!shouldReclaim(sample, triggerMb)) return;
-        if (now() - lastReclaimAt < minIntervalMs) return;
+        if (!shouldReclaim(sample, triggerMb)) {
+          passesAtFloor = 0;
+          steadyStateAnnounced = false;
+          return;
+        }
+        const sinceLast = now() - lastReclaimAt;
+        if (sinceLast < minIntervalMs) return;
+        passesAtFloor = sinceLast <= minIntervalMs * 2 ? passesAtFloor + 1 : 1;
         lastReclaimAt = now();
         const startedAt = now();
         try {
@@ -108137,6 +108688,10 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
         }
         const after = read();
         sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
+        if (passesAtFloor >= 6 && !steadyStateAnnounced) {
+          steadyStateAnnounced = true;
+          sink.warn(`[mem] reclaim ${label} has run at the floor for ${passesAtFloor} consecutive passes (every ${minIntervalMs}ms) \u2014 the stop-the-world is now STEADY STATE, not a rescue. The allocation source is what needs the fix; this pass only bounds its peak.`);
+        }
       };
       let mode = "steady";
       let lastLoggedAt = Number.NEGATIVE_INFINITY;
@@ -108150,7 +108705,7 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
           const due = at - lastLoggedAt >= intervalMs;
           if (mode === "escalated" || due) {
             lastLoggedAt = at;
-            const line = format2(label, sample);
+            const line = format2(label, sample, loopDelay?.read());
             if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
             else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
             else sink.info(line);
@@ -108163,11 +108718,13 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
       const timer = setInterval(tick, probeIntervalMs);
       timer.unref?.();
       tick();
+      if (heapCeilingOrigin(execArgv) === "v8-default") sink.info(`[mem] ${label} heap ceiling is V8's DEFAULT (${read().heapLimitMb}MB) \u2014 no --max-old-space-size on argv. Nothing here CHOSE that number; it is derived from host RAM and moves with it.`);
       let stopped = false;
       return () => {
         if (stopped) return;
         stopped = true;
         clearInterval(timer);
+        loopDelay?.stop();
       };
     }
     var RUNNER_HEAP_WATCH_INTERVAL_MS = 3e5;
@@ -109259,6 +109816,10 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
     }
     function createBrokerDeviceManagerApi(opts) {
       const { api, addonId, nodeId, eventBus, registry } = opts;
+      const deviceSliceSource = (0, _camstack_types_addon.createEventBusSliceSource)({
+        eventBus,
+        api
+      });
       let selfApi;
       const deviceRebuildFactories = /* @__PURE__ */ new Map();
       const buildContext = (stableId, id, parentDeviceId = null, initialRuntimeState = {}, persistedConfig = {}, deviceMeta = null) => {
@@ -109303,7 +109864,7 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
             metadata: null
           },
           fetchDevice: async (deviceId) => {
-            return (0, _camstack_types_addon.createDeviceProxy)(api, await api.deviceManager.getBindings.query({ deviceId }));
+            return (0, _camstack_types_addon.createDeviceProxy)(api, await api.deviceManager.getBindings.query({ deviceId }), { stateSource: deviceSliceSource });
           },
           get devices() {
             return selfApi;
@@ -114202,6 +114763,10 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
       const api = (0, _trpc_client.createTRPCClient)({ links });
       const scopedLogger = options?.createLogger?.(addonId) ?? (runtime.mode === "broker" ? createRemoteLogger(runtime.broker, addonId) : createUdsLogger(runtime.client, addonId, nodeId));
       const scopedEventBus = runtime.mode === "broker" ? createBrokerEventBus(runtime.broker, addonId) : createUdsEventBus(runtime.client, addonId);
+      const deviceSliceSource = (0, _camstack_types_addon.createEventBusSliceSource)({
+        eventBus: scopedEventBus,
+        api
+      });
       const workerDisposerChain = new _camstack_types_addon.DisposerChain({ onError: (err, index) => {
         scopedLogger.error(`Disposer #${index} threw during teardown`, { meta: { error: err instanceof Error ? err.message : String(err) } });
       } });
@@ -114437,10 +115002,10 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
         },
         fetchDevice: async (deviceId) => {
           const cached = bindingCache.get(deviceId);
-          if (cached) return (0, _camstack_types_addon.createDeviceProxy)(api, cached);
+          if (cached) return (0, _camstack_types_addon.createDeviceProxy)(api, cached, { stateSource: deviceSliceSource });
           const binding = await api.deviceManager.getBindings.query({ deviceId });
           bindingCache.set(deviceId, binding);
-          return (0, _camstack_types_addon.createDeviceProxy)(api, binding);
+          return (0, _camstack_types_addon.createDeviceProxy)(api, binding, { stateSource: deviceSliceSource });
         },
         useCapability(capName, scope = { type: "global" }) {
           return getOrCreateHandle(capName, scope, Number.POSITIVE_INFINITY);
@@ -115038,6 +115603,752 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
   }
 });
 
+// ../system/dist/lan-http-bind-DmgpFP6_.js
+var require_lan_http_bind_DmgpFP6 = __commonJS({
+  "../system/dist/lan-http-bind-DmgpFP6_.js"(exports) {
+    "use strict";
+    var require_chunk = require_chunk_Cek0wNdY();
+    var node_crypto = __require("crypto");
+    var node_fs_promises = __require("fs/promises");
+    var node_path = __require("path");
+    var node_child_process = __require("child_process");
+    var node_util = __require("util");
+    var node_os = __require("os");
+    node_os = require_chunk.__toESM(node_os);
+    var node_fs = __require("fs");
+    var node_http = __require("http");
+    var node_net = __require("net");
+    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+    var MAX_LEAF_VALIDITY_DAYS = 397;
+    var LEAF_RENEWAL_WINDOW_DAYS = 30;
+    var CA_VALIDITY_DAYS = 3650;
+    var MS_PER_DAY = 864e5;
+    var REASONS_REQUIRING_NEW_CA = [
+      "missing",
+      "unreadable",
+      "no-local-ca",
+      "ca-expiring"
+    ];
+    function reasonRequiresNewCa(reason) {
+      return REASONS_REQUIRING_NEW_CA.includes(reason);
+    }
+    function parse4(pem) {
+      try {
+        return new node_crypto.X509Certificate(pem);
+      } catch {
+        return null;
+      }
+    }
+    function daysBetween(from, to) {
+      return (to.getTime() - from.getTime()) / MS_PER_DAY;
+    }
+    function hasServerAuthEku(leaf) {
+      const eku = leaf.keyUsage;
+      return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+    }
+    function keyMatches(leaf, keyPem) {
+      try {
+        return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
+      } catch {
+        return false;
+      }
+    }
+    function coversIdentity(leaf, identity) {
+      for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
+      for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+      return true;
+    }
+    function evaluateExistingCert(input) {
+      const leaf = parse4(input.chainPem);
+      const ca = parse4(input.caPem);
+      if (leaf === null || ca === null) return "unreadable";
+      if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+      if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+      if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+      if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+      if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+      if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+      if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+      return null;
+    }
+    var VOLATILE_INTERFACE_PREFIXES = [
+      "docker",
+      "br-",
+      "veth",
+      "virbr",
+      "cni",
+      "flannel",
+      "tun",
+      "utun",
+      "tap",
+      "wg",
+      "zt",
+      "tailscale",
+      "ppp",
+      "awdl",
+      "llw"
+    ];
+    var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+    function isIpv4(value) {
+      return (0, node_net.isIP)(value) === 4;
+    }
+    function isIpv6(value) {
+      return (0, node_net.isIP)(value) === 6;
+    }
+    function isLinkLocal(value) {
+      if (isIpv4(value)) return value.startsWith("169.254.");
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      if (firstGroup === "") return false;
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+    }
+    function isUniqueLocalIpv6(value) {
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+    }
+    function isVolatileInterface(name) {
+      const lower = name.toLowerCase();
+      return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    }
+    function isStableGateAddress(address) {
+      if (isLinkLocal(address)) return false;
+      if (isIpv4(address)) return true;
+      return isUniqueLocalIpv6(address);
+    }
+    function addSan(dns, ips, value) {
+      const trimmed = value.trim();
+      if (trimmed === "") return;
+      if ((0, node_net.isIP)(trimmed) !== 0) {
+        if (!isLinkLocal(trimmed)) ips.add(trimmed);
+        return;
+      }
+      if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+    }
+    function collectCertIdentity(options) {
+      const dnsNames = /* @__PURE__ */ new Set();
+      const ipAddresses = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
+      const requiredDnsNames = /* @__PURE__ */ new Set();
+      const requiredIpAddresses = /* @__PURE__ */ new Set(["127.0.0.1"]);
+      for (const name of [
+        "localhost",
+        options.commonName,
+        node_os.hostname()
+      ]) {
+        addSan(dnsNames, ipAddresses, name);
+        addSan(requiredDnsNames, requiredIpAddresses, name);
+      }
+      for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
+        if (addr.internal) continue;
+        if (isLinkLocal(addr.address)) continue;
+        ipAddresses.add(addr.address);
+        if (isVolatileInterface(ifaceName)) continue;
+        if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+      }
+      for (const san of options.extraSans) {
+        addSan(dnsNames, ipAddresses, san);
+        addSan(requiredDnsNames, requiredIpAddresses, san);
+      }
+      return {
+        dnsNames: [...dnsNames],
+        ipAddresses: [...ipAddresses],
+        requiredDnsNames: [...requiredDnsNames],
+        requiredIpAddresses: [...requiredIpAddresses]
+      };
+    }
+    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var CA_COMMON_NAME = "CamStack Local CA";
+    function sanValue(identity) {
+      const parts = [];
+      for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+      for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
+      return parts.join(",");
+    }
+    async function generateCa(tmpDir) {
+      const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
+      const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
+      await execFileAsync("openssl", [
+        "req",
+        "-x509",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-sha256",
+        "-days",
+        String(CA_VALIDITY_DAYS),
+        "-keyout",
+        caKeyPath,
+        "-out",
+        caCertPath,
+        "-subj",
+        `/CN=${CA_COMMON_NAME}`,
+        "-addext",
+        "basicConstraints=critical,CA:TRUE,pathlen:0",
+        "-addext",
+        "keyUsage=critical,keyCertSign,cRLSign",
+        "-addext",
+        "subjectKeyIdentifier=hash"
+      ]);
+      await (0, node_fs_promises.chmod)(caKeyPath, 384);
+      return {
+        caCertPath,
+        caKeyPath
+      };
+    }
+    async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+      const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
+      const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
+      const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
+      const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
+      await (0, node_fs_promises.writeFile)(extPath, [
+        "basicConstraints=critical,CA:FALSE",
+        "keyUsage=critical,digitalSignature,keyEncipherment",
+        "extendedKeyUsage=serverAuth",
+        "subjectKeyIdentifier=hash",
+        "authorityKeyIdentifier=keyid,issuer",
+        `subjectAltName=${sanValue(identity)}`,
+        ""
+      ].join("\n"), "utf-8");
+      await execFileAsync("openssl", [
+        "req",
+        "-new",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-sha256",
+        "-keyout",
+        keyPath,
+        "-out",
+        csrPath,
+        "-subj",
+        `/CN=${commonName}`
+      ]);
+      await execFileAsync("openssl", [
+        "x509",
+        "-req",
+        "-in",
+        csrPath,
+        "-CA",
+        ca.caCertPath,
+        "-CAkey",
+        ca.caKeyPath,
+        "-set_serial",
+        `0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
+        "-days",
+        String(validDays),
+        "-sha256",
+        "-extfile",
+        extPath,
+        "-out",
+        certPath
+      ]);
+      await (0, node_fs_promises.chmod)(keyPath, 384);
+      await (0, node_fs_promises.rm)(csrPath, { force: true });
+      await (0, node_fs_promises.rm)(extPath, { force: true });
+      return {
+        certPath,
+        keyPath
+      };
+    }
+    var DEFAULT_COMMON_NAME = "camstack.local";
+    async function ensureTlsCert(dataDir, options) {
+      const tlsDir2 = (0, node_path.join)(dataDir, "tls");
+      const paths = {
+        certPath: (0, node_path.join)(tlsDir2, "camstack.crt"),
+        keyPath: (0, node_path.join)(tlsDir2, "camstack.key"),
+        caCertPath: (0, node_path.join)(tlsDir2, "camstack-ca.crt"),
+        caKeyPath: (0, node_path.join)(tlsDir2, "camstack-ca.key")
+      };
+      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+      const validDays = Math.min(options?.validDays ?? 397, 397);
+      const identity = collectCertIdentity({
+        commonName,
+        extraSans: options?.extraSans ?? []
+      });
+      const reason = decideRegeneration(paths, identity);
+      if (reason === null) return describe(paths, false, null, false, null, null);
+      const previousFingerprint = readFingerprint(paths.certPath);
+      const caRotated = reasonRequiresNewCa(reason);
+      (0, node_fs.mkdirSync)(tlsDir2, { recursive: true });
+      try {
+        await regenerate(paths, identity, commonName, validDays, caRotated);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!canKeepServing(paths)) throw err;
+        return describe(paths, false, null, false, null, message);
+      }
+      return describe(paths, true, reason, caRotated, previousFingerprint, null);
+    }
+    async function reissueTlsLeaf(dataDir, options) {
+      const tlsDir2 = (0, node_path.join)(dataDir, "tls");
+      const paths = {
+        certPath: (0, node_path.join)(tlsDir2, "camstack.crt"),
+        keyPath: (0, node_path.join)(tlsDir2, "camstack.key"),
+        caCertPath: (0, node_path.join)(tlsDir2, "camstack-ca.crt"),
+        caKeyPath: (0, node_path.join)(tlsDir2, "camstack-ca.key")
+      };
+      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
+      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+      const validDays = Math.min(options?.validDays ?? 397, 397);
+      const identity = collectCertIdentity({
+        commonName,
+        extraSans: options?.extraSans ?? []
+      });
+      const previousFingerprint = readFingerprint(paths.certPath);
+      (0, node_fs.mkdirSync)(tlsDir2, { recursive: true });
+      await regenerate(paths, identity, commonName, validDays, false);
+      return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+    }
+    function canKeepServing(paths) {
+      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return false;
+      if (!(0, node_fs.existsSync)(paths.caCertPath)) return false;
+      return readFingerprint(paths.certPath) !== null;
+    }
+    function readFingerprint(certPath) {
+      try {
+        return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
+      } catch {
+        return null;
+      }
+    }
+    function decideRegeneration(paths, identity) {
+      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
+      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
+      try {
+        return evaluateExistingCert({
+          chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
+          keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
+          caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
+          identity,
+          now: /* @__PURE__ */ new Date()
+        });
+      } catch {
+        return "unreadable";
+      }
+    }
+    async function regenerate(paths, identity, commonName, validDays, newCa) {
+      const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
+      try {
+        const ca = newCa ? await generateCa(scratch) : {
+          caCertPath: paths.caCertPath,
+          caKeyPath: paths.caKeyPath
+        };
+        const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+        const chainPath = (0, node_path.join)(scratch, "chain.crt");
+        await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}
+${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
+`, "utf-8");
+        if (newCa) {
+          await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
+          await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
+          (0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+          (0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+          await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
+        }
+        await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
+        await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
+        (0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
+        (0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+        await (0, node_fs_promises.chmod)(paths.keyPath, 384);
+      } finally {
+        await (0, node_fs_promises.rm)(scratch, {
+          recursive: true,
+          force: true
+        });
+      }
+    }
+    function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+      const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
+      const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
+      const san = leaf.subjectAltName ?? "";
+      return {
+        ...paths,
+        generated,
+        reason,
+        caRotated,
+        fingerprintSha256: leaf.fingerprint256,
+        previousFingerprintSha256,
+        caFingerprintSha256: ca.fingerprint256,
+        validTo: new Date(leaf.validTo).toISOString(),
+        sans: san === "" ? [] : san.split(", "),
+        reissueError
+      };
+    }
+    function loadTlsCert(certPath, keyPath) {
+      return {
+        cert: (0, node_fs.readFileSync)(certPath),
+        key: (0, node_fs.readFileSync)(keyPath)
+      };
+    }
+    function validateUploadedTls(certPem, keyPem) {
+      let leaf;
+      try {
+        leaf = new node_crypto.X509Certificate(certPem);
+      } catch {
+        return {
+          ok: false,
+          error: "Certificate PEM could not be parsed."
+        };
+      }
+      try {
+        if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
+          ok: false,
+          error: "Private key does not match the certificate."
+        };
+      } catch {
+        return {
+          ok: false,
+          error: "Private key PEM could not be parsed."
+        };
+      }
+      const eku = leaf.keyUsage;
+      if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+        ok: false,
+        error: "Certificate is missing extendedKeyUsage = serverAuth."
+      };
+      return {
+        ok: true,
+        fingerprintSha256: leaf.fingerprint256,
+        validTo: new Date(leaf.validTo).toISOString()
+      };
+    }
+    function tlsDir(dataDir) {
+      return (0, node_path.join)(dataDir, "tls");
+    }
+    function readTlsMode(dataDir) {
+      const marker = (0, node_path.join)(tlsDir(dataDir), "mode");
+      if ((0, node_fs.existsSync)(marker)) {
+        const raw = (0, node_fs.readFileSync)(marker, "utf-8").trim();
+        if (raw === "uploaded") return "uploaded";
+        if (raw === "disabled") return "disabled";
+      }
+      return (0, node_fs.existsSync)((0, node_path.join)(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
+    }
+    function writeTlsMode(dataDir, mode) {
+      (0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+      (0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "mode"), `${mode}
+`, "utf-8");
+    }
+    function readExtraSans(dataDir) {
+      const path = (0, node_path.join)(tlsDir(dataDir), "extra-sans.json");
+      if (!(0, node_fs.existsSync)(path)) return [];
+      try {
+        const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
+        if (!Array.isArray(parsed)) return [];
+        return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+      } catch {
+        return [];
+      }
+    }
+    function writeExtraSans(dataDir, sans) {
+      (0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+      (0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}
+`, "utf-8");
+    }
+    function readTlsAccessStatus(dataDir, restartRequired = false) {
+      const dir = tlsDir(dataDir);
+      const certPath = (0, node_path.join)(dir, "camstack.crt");
+      const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
+      const mode = readTlsMode(dataDir);
+      if (!(0, node_fs.existsSync)(certPath)) return {
+        mode: "disabled",
+        leafFingerprintSha256: null,
+        caFingerprintSha256: null,
+        validTo: null,
+        sans: [],
+        caCertPem: (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null,
+        reissueError: null,
+        restartRequired
+      };
+      try {
+        const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
+        const caPem = (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null;
+        const ca = caPem !== null ? new node_crypto.X509Certificate(caPem) : null;
+        const san = leaf.subjectAltName ?? "";
+        return {
+          mode,
+          leafFingerprintSha256: leaf.fingerprint256,
+          caFingerprintSha256: ca?.fingerprint256 ?? null,
+          validTo: new Date(leaf.validTo).toISOString(),
+          sans: san === "" ? [] : san.split(", "),
+          caCertPem: caPem,
+          reissueError: null,
+          restartRequired
+        };
+      } catch {
+        return {
+          mode,
+          leafFingerprintSha256: null,
+          caFingerprintSha256: null,
+          validTo: null,
+          sans: [],
+          caCertPem: null,
+          reissueError: "Certificate on disk could not be parsed.",
+          restartRequired
+        };
+      }
+    }
+    var DEFAULT_HTTP_PORT = 4480;
+    var handlers = null;
+    var server = null;
+    var pending = null;
+    var state = {
+      listening: false,
+      error: null,
+      port: DEFAULT_HTTP_PORT
+    };
+    var boundRequestedHost = null;
+    var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+    function allFamiliesListenHost(host) {
+      if (host === "0.0.0.0" || host === "*" || host === "") return {
+        host: "::",
+        ipv6Only: false
+      };
+      return {
+        host,
+        ipv6Only: false
+      };
+    }
+    function registerLanHttpHandler(next) {
+      handlers = next;
+    }
+    function readLanHttpState() {
+      return state;
+    }
+    async function applyLanHttp(options) {
+      pending = options;
+      if (!options.enabled) {
+        await closeLanHttp();
+        state = {
+          listening: false,
+          error: null,
+          port: options.port
+        };
+        return state;
+      }
+      if (handlers === null) {
+        state = {
+          listening: false,
+          error: "HTTP listener is not registered yet",
+          port: options.port
+        };
+        return state;
+      }
+      if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+      await closeLanHttp();
+      try {
+        const bound = await listenHttp(options.port, options.host, handlers);
+        server = bound;
+        boundRequestedHost = options.host;
+        const addr = bound.address();
+        state = {
+          listening: true,
+          error: null,
+          port: typeof addr === "object" && addr !== null ? addr.port : options.port
+        };
+        return state;
+      } catch (err) {
+        server = null;
+        state = {
+          listening: false,
+          error: err instanceof Error ? err.message : String(err),
+          port: options.port
+        };
+        return state;
+      }
+    }
+    async function bindPendingLanHttp() {
+      if (pending === null) return applyLanHttp({
+        enabled: true,
+        port: DEFAULT_HTTP_PORT,
+        host: "0.0.0.0"
+      });
+      return applyLanHttp(pending);
+    }
+    async function closeLanHttp() {
+      const current = server;
+      server = null;
+      boundRequestedHost = null;
+      if (current === null) return;
+      await new Promise((resolve) => {
+        current.close(() => resolve());
+      });
+    }
+    function listenHttp(port, host, next) {
+      const resolved = allFamiliesListenHost(host);
+      return listenOn(port, resolved, next).catch((err) => {
+        if (resolved.host === "::" && host !== "::") return listenOn(port, {
+          host: "0.0.0.0",
+          ipv6Only: false
+        }, next);
+        throw err;
+      });
+    }
+    function listenOn(port, bind, next) {
+      return new Promise((resolve, reject) => {
+        const created = (0, node_http.createServer)(next.onRequest);
+        created.on("upgrade", next.onUpgrade);
+        const onError = (err) => {
+          created.off("listening", onListening);
+          created.close();
+          reject(err);
+        };
+        const onListening = () => {
+          created.off("error", onError);
+          resolve(created);
+        };
+        created.once("error", onError);
+        created.once("listening", onListening);
+        created.listen({
+          port,
+          host: bind.host,
+          ipv6Only: bind.ipv6Only
+        });
+      });
+    }
+    Object.defineProperty(exports, "CA_COMMON_NAME", {
+      enumerable: true,
+      get: function() {
+        return CA_COMMON_NAME;
+      }
+    });
+    Object.defineProperty(exports, "CA_VALIDITY_DAYS", {
+      enumerable: true,
+      get: function() {
+        return CA_VALIDITY_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "DEFAULT_LAN_HTTP_PORT", {
+      enumerable: true,
+      get: function() {
+        return DEFAULT_LAN_HTTP_PORT;
+      }
+    });
+    Object.defineProperty(exports, "LEAF_RENEWAL_WINDOW_DAYS", {
+      enumerable: true,
+      get: function() {
+        return LEAF_RENEWAL_WINDOW_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
+      enumerable: true,
+      get: function() {
+        return MAX_LEAF_VALIDITY_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "SERVER_AUTH_OID", {
+      enumerable: true,
+      get: function() {
+        return SERVER_AUTH_OID;
+      }
+    });
+    Object.defineProperty(exports, "allFamiliesListenHost", {
+      enumerable: true,
+      get: function() {
+        return allFamiliesListenHost;
+      }
+    });
+    Object.defineProperty(exports, "applyLanHttp", {
+      enumerable: true,
+      get: function() {
+        return applyLanHttp;
+      }
+    });
+    Object.defineProperty(exports, "bindPendingLanHttp", {
+      enumerable: true,
+      get: function() {
+        return bindPendingLanHttp;
+      }
+    });
+    Object.defineProperty(exports, "closeLanHttp", {
+      enumerable: true,
+      get: function() {
+        return closeLanHttp;
+      }
+    });
+    Object.defineProperty(exports, "collectCertIdentity", {
+      enumerable: true,
+      get: function() {
+        return collectCertIdentity;
+      }
+    });
+    Object.defineProperty(exports, "ensureTlsCert", {
+      enumerable: true,
+      get: function() {
+        return ensureTlsCert;
+      }
+    });
+    Object.defineProperty(exports, "evaluateExistingCert", {
+      enumerable: true,
+      get: function() {
+        return evaluateExistingCert;
+      }
+    });
+    Object.defineProperty(exports, "loadTlsCert", {
+      enumerable: true,
+      get: function() {
+        return loadTlsCert;
+      }
+    });
+    Object.defineProperty(exports, "readExtraSans", {
+      enumerable: true,
+      get: function() {
+        return readExtraSans;
+      }
+    });
+    Object.defineProperty(exports, "readLanHttpState", {
+      enumerable: true,
+      get: function() {
+        return readLanHttpState;
+      }
+    });
+    Object.defineProperty(exports, "readTlsAccessStatus", {
+      enumerable: true,
+      get: function() {
+        return readTlsAccessStatus;
+      }
+    });
+    Object.defineProperty(exports, "readTlsMode", {
+      enumerable: true,
+      get: function() {
+        return readTlsMode;
+      }
+    });
+    Object.defineProperty(exports, "registerLanHttpHandler", {
+      enumerable: true,
+      get: function() {
+        return registerLanHttpHandler;
+      }
+    });
+    Object.defineProperty(exports, "reissueTlsLeaf", {
+      enumerable: true,
+      get: function() {
+        return reissueTlsLeaf;
+      }
+    });
+    Object.defineProperty(exports, "validateUploadedTls", {
+      enumerable: true,
+      get: function() {
+        return validateUploadedTls;
+      }
+    });
+    Object.defineProperty(exports, "writeExtraSans", {
+      enumerable: true,
+      get: function() {
+        return writeExtraSans;
+      }
+    });
+    Object.defineProperty(exports, "writeTlsMode", {
+      enumerable: true,
+      get: function() {
+        return writeTlsMode;
+      }
+    });
+  }
+});
+
 // ../system/dist/custom-action-registry-jY0NOZK8.js
 var require_custom_action_registry_jY0NOZK8 = __commonJS({
   "../system/dist/custom-action-registry-jY0NOZK8.js"(exports) {
@@ -118837,7 +120148,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_DnhGRFEn();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -118861,9 +120172,10 @@ var require_dist3 = __commonJS({
     var require_builtins_system_config_system_config_addon = require_system_config_addon();
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
-    var require_file_data_plane = require_file_data_plane_DUHPHa_Y();
-    var require_manifest_python_deps = require_manifest_python_deps_CwBbX4Ut();
+    var require_file_data_plane = require_file_data_plane_DO8KbxCe();
+    var require_manifest_python_deps = require_manifest_python_deps_B3_4YiDK();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
+    var require_lan_http_bind = require_lan_http_bind_DmgpFP6();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -118883,7 +120195,6 @@ var require_dist3 = __commonJS({
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
-    var node_net = __require("net");
     var node_url = __require("url");
     var node_events = __require("events");
     var node_stream = __require("stream");
@@ -120169,7 +121480,7 @@ var require_dist3 = __commonJS({
         if (node.children) for (const child of node.children) this.validateNode(child, errors, warnings);
       }
     };
-    var execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
+    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
     var PythonEnvManager = class {
       venvPath;
       cachedProbe = null;
@@ -120179,12 +121490,12 @@ var require_dist3 = __commonJS({
       async probe() {
         if (this.cachedProbe) return this.cachedProbe;
         for (const cmd of ["python3", "python"]) try {
-          const { stdout } = await execFileAsync$4(cmd, ["--version"]);
+          const { stdout } = await execFileAsync$3(cmd, ["--version"]);
           const version2 = stdout.trim().replace("Python ", "");
           const major = parseInt(version2.split(".")[0] ?? "0", 10);
           const minor = parseInt(version2.split(".")[1] ?? "0", 10);
           if (major < 3 || major === 3 && minor < 10) continue;
-          const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
+          const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
           this.cachedProbe = {
             available: true,
             version: version2,
@@ -120200,13 +121511,13 @@ var require_dist3 = __commonJS({
       async ensure(options) {
         const probe = await this.probe();
         if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-        if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
+        if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
           "-m",
           "venv",
           this.venvPath
         ]);
         const venvPython = node_path.join(this.venvPath, "bin", "python");
-        if (options.packages.length > 0) await execFileAsync$4(venvPython, [
+        if (options.packages.length > 0) await execFileAsync$3(venvPython, [
           "-m",
           "pip",
           "install",
@@ -120648,338 +121959,6 @@ var require_dist3 = __commonJS({
         };
       }
     };
-    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-    var MAX_LEAF_VALIDITY_DAYS = 397;
-    var LEAF_RENEWAL_WINDOW_DAYS = 30;
-    var CA_VALIDITY_DAYS = 3650;
-    var MS_PER_DAY = 864e5;
-    var REASONS_REQUIRING_NEW_CA = [
-      "missing",
-      "unreadable",
-      "no-local-ca",
-      "ca-expiring"
-    ];
-    function reasonRequiresNewCa(reason) {
-      return REASONS_REQUIRING_NEW_CA.includes(reason);
-    }
-    function parse$1(pem) {
-      try {
-        return new node_crypto.X509Certificate(pem);
-      } catch {
-        return null;
-      }
-    }
-    function daysBetween(from, to) {
-      return (to.getTime() - from.getTime()) / MS_PER_DAY;
-    }
-    function hasServerAuthEku(leaf) {
-      const eku = leaf.keyUsage;
-      return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
-    }
-    function keyMatches(leaf, keyPem) {
-      try {
-        return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
-      } catch {
-        return false;
-      }
-    }
-    function coversIdentity(leaf, identity) {
-      for (const name2 of identity.requiredDnsNames) if (leaf.checkHost(name2) === void 0) return false;
-      for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
-      return true;
-    }
-    function evaluateExistingCert(input) {
-      const leaf = parse$1(input.chainPem);
-      const ca = parse$1(input.caPem);
-      if (leaf === null || ca === null) return "unreadable";
-      if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
-      if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
-      if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
-      if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
-      if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
-      if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
-      if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
-      return null;
-    }
-    var VOLATILE_INTERFACE_PREFIXES = [
-      "docker",
-      "br-",
-      "veth",
-      "virbr",
-      "cni",
-      "flannel",
-      "tun",
-      "utun",
-      "tap",
-      "wg",
-      "zt",
-      "tailscale",
-      "ppp",
-      "awdl",
-      "llw"
-    ];
-    var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-    function isIpv4(value) {
-      return (0, node_net.isIP)(value) === 4;
-    }
-    function isIpv6(value) {
-      return (0, node_net.isIP)(value) === 6;
-    }
-    function isLinkLocal(value) {
-      if (isIpv4(value)) return value.startsWith("169.254.");
-      if (!isIpv6(value)) return false;
-      const firstGroup = value.split(":")[0] ?? "";
-      if (firstGroup === "") return false;
-      const parsed = Number.parseInt(firstGroup, 16);
-      return Number.isFinite(parsed) && (parsed & 65472) === 65152;
-    }
-    function isUniqueLocalIpv6(value) {
-      if (!isIpv6(value)) return false;
-      const firstGroup = value.split(":")[0] ?? "";
-      const parsed = Number.parseInt(firstGroup, 16);
-      return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-    }
-    function isVolatileInterface(name2) {
-      const lower = name2.toLowerCase();
-      return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
-    }
-    function isStableGateAddress(address) {
-      if (isLinkLocal(address)) return false;
-      if (isIpv4(address)) return true;
-      return isUniqueLocalIpv6(address);
-    }
-    function addSan(dns, ips, value) {
-      const trimmed = value.trim();
-      if (trimmed === "") return;
-      if ((0, node_net.isIP)(trimmed) !== 0) {
-        if (!isLinkLocal(trimmed)) ips.add(trimmed);
-        return;
-      }
-      if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
-    }
-    function collectCertIdentity(options) {
-      const dnsNames = /* @__PURE__ */ new Set();
-      const ipAddresses = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
-      const requiredDnsNames = /* @__PURE__ */ new Set();
-      const requiredIpAddresses = /* @__PURE__ */ new Set(["127.0.0.1"]);
-      for (const name2 of [
-        "localhost",
-        options.commonName,
-        node_os.hostname()
-      ]) {
-        addSan(dnsNames, ipAddresses, name2);
-        addSan(requiredDnsNames, requiredIpAddresses, name2);
-      }
-      for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
-        if (addr.internal) continue;
-        if (isLinkLocal(addr.address)) continue;
-        ipAddresses.add(addr.address);
-        if (isVolatileInterface(ifaceName)) continue;
-        if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
-      }
-      for (const san of options.extraSans) {
-        addSan(dnsNames, ipAddresses, san);
-        addSan(requiredDnsNames, requiredIpAddresses, san);
-      }
-      return {
-        dnsNames: [...dnsNames],
-        ipAddresses: [...ipAddresses],
-        requiredDnsNames: [...requiredDnsNames],
-        requiredIpAddresses: [...requiredIpAddresses]
-      };
-    }
-    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
-    var CA_COMMON_NAME = "CamStack Local CA";
-    function sanValue(identity) {
-      const parts = [];
-      for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
-      for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
-      return parts.join(",");
-    }
-    async function generateCa(tmpDir) {
-      const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
-      const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
-      await execFileAsync$3("openssl", [
-        "req",
-        "-x509",
-        "-newkey",
-        "rsa:2048",
-        "-nodes",
-        "-sha256",
-        "-days",
-        String(CA_VALIDITY_DAYS),
-        "-keyout",
-        caKeyPath,
-        "-out",
-        caCertPath,
-        "-subj",
-        `/CN=${CA_COMMON_NAME}`,
-        "-addext",
-        "basicConstraints=critical,CA:TRUE,pathlen:0",
-        "-addext",
-        "keyUsage=critical,keyCertSign,cRLSign",
-        "-addext",
-        "subjectKeyIdentifier=hash"
-      ]);
-      await (0, node_fs_promises.chmod)(caKeyPath, 384);
-      return {
-        caCertPath,
-        caKeyPath
-      };
-    }
-    async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
-      const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
-      const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
-      const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
-      const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
-      await (0, node_fs_promises.writeFile)(extPath, [
-        "basicConstraints=critical,CA:FALSE",
-        "keyUsage=critical,digitalSignature,keyEncipherment",
-        "extendedKeyUsage=serverAuth",
-        "subjectKeyIdentifier=hash",
-        "authorityKeyIdentifier=keyid,issuer",
-        `subjectAltName=${sanValue(identity)}`,
-        ""
-      ].join("\n"), "utf-8");
-      await execFileAsync$3("openssl", [
-        "req",
-        "-new",
-        "-newkey",
-        "rsa:2048",
-        "-nodes",
-        "-sha256",
-        "-keyout",
-        keyPath,
-        "-out",
-        csrPath,
-        "-subj",
-        `/CN=${commonName}`
-      ]);
-      await execFileAsync$3("openssl", [
-        "x509",
-        "-req",
-        "-in",
-        csrPath,
-        "-CA",
-        ca.caCertPath,
-        "-CAkey",
-        ca.caKeyPath,
-        "-set_serial",
-        `0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
-        "-days",
-        String(validDays),
-        "-sha256",
-        "-extfile",
-        extPath,
-        "-out",
-        certPath
-      ]);
-      await (0, node_fs_promises.chmod)(keyPath, 384);
-      await (0, node_fs_promises.rm)(csrPath, { force: true });
-      await (0, node_fs_promises.rm)(extPath, { force: true });
-      return {
-        certPath,
-        keyPath
-      };
-    }
-    var DEFAULT_COMMON_NAME = "camstack.local";
-    async function ensureTlsCert(dataDir, options) {
-      const tlsDir = (0, node_path.join)(dataDir, "tls");
-      const paths = {
-        certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-        keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-        caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-        caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-      };
-      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-      const validDays = Math.min(options?.validDays ?? 397, 397);
-      const identity = collectCertIdentity({
-        commonName,
-        extraSans: options?.extraSans ?? []
-      });
-      const reason = decideRegeneration(paths, identity);
-      if (reason === null) return describe(paths, false, null, false, null);
-      const previousFingerprint = readFingerprint(paths.certPath);
-      const caRotated = reasonRequiresNewCa(reason);
-      (0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-      await regenerate(paths, identity, commonName, validDays, caRotated);
-      return describe(paths, true, reason, caRotated, previousFingerprint);
-    }
-    function readFingerprint(certPath) {
-      try {
-        return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
-      } catch {
-        return null;
-      }
-    }
-    function decideRegeneration(paths, identity) {
-      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
-      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
-      try {
-        return evaluateExistingCert({
-          chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
-          keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
-          caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
-          identity,
-          now: /* @__PURE__ */ new Date()
-        });
-      } catch {
-        return "unreadable";
-      }
-    }
-    async function regenerate(paths, identity, commonName, validDays, newCa) {
-      const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
-      try {
-        const ca = newCa ? await generateCa(scratch) : {
-          caCertPath: paths.caCertPath,
-          caKeyPath: paths.caKeyPath
-        };
-        const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
-        const chainPath = (0, node_path.join)(scratch, "chain.crt");
-        await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}
-${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
-`, "utf-8");
-        if (newCa) {
-          await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
-          await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
-          (0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
-          (0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-          await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
-        }
-        await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
-        await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
-        (0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
-        (0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-        await (0, node_fs_promises.chmod)(paths.keyPath, 384);
-      } finally {
-        await (0, node_fs_promises.rm)(scratch, {
-          recursive: true,
-          force: true
-        });
-      }
-    }
-    function describe(paths, generated, reason, caRotated, previousFingerprintSha256) {
-      const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
-      const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
-      const san = leaf.subjectAltName ?? "";
-      return {
-        ...paths,
-        generated,
-        reason,
-        caRotated,
-        fingerprintSha256: leaf.fingerprint256,
-        previousFingerprintSha256,
-        caFingerprintSha256: ca.fingerprint256,
-        validTo: new Date(leaf.validTo).toISOString(),
-        sans: san === "" ? [] : san.split(", ")
-      };
-    }
-    function loadTlsCert(certPath, keyPath) {
-      return {
-        cert: (0, node_fs.readFileSync)(certPath),
-        key: (0, node_fs.readFileSync)(keyPath)
-      };
-    }
     function serializeSetting(value) {
       if (typeof value === "number") return {
         value: String(value),
@@ -121418,7 +122397,7 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
       if (missing.length > 0) throw new Error(`${options.addonName} \u2014 required native module(s) missing a compiled .node after install (bundled-copy + prebuild-fetch both failed): ${missing.join(", ")}`);
       return results;
     }
-    function isRecord$1(value) {
+    function isRecord$2(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
     }
     var PACKAGE_JSON_LOOKUP_DEPTH = 4;
@@ -121458,9 +122437,9 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
       return import(`${(0, node_url.pathToFileURL)(entryPath).href}?v=${encodeURIComponent(bust)}`);
     }
     function toAddonPackageManifest(value) {
-      if (!isRecord$1(value)) return void 0;
+      if (!isRecord$2(value)) return void 0;
       if (!Array.isArray(value.addons)) return void 0;
-      if (!value.addons.every((a) => isRecord$1(a) && typeof a.id === "string")) return void 0;
+      if (!value.addons.every((a) => isRecord$2(a) && typeof a.id === "string")) return void 0;
       return value;
     }
     var noopLogger$1 = {
@@ -121602,7 +122581,7 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
         }
         if (!node_fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
         const modUnknown = await importAddonModuleFresh(entryPath);
-        const mod = isRecord$1(modUnknown) ? modUnknown : {};
+        const mod = isRecord$2(modUnknown) ? modUnknown : {};
         const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
         if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
         this.addons.set(declaration.id, {
@@ -121618,7 +122597,7 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
       /** Load addon from a direct path (for development/testing) */
       async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
         const modUnknown = await importAddonModuleFresh(modulePath);
-        const mod = isRecord$1(modUnknown) ? modUnknown : {};
+        const mod = isRecord$2(modUnknown) ? modUnknown : {};
         const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
         if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
         this.addons.set(addonId, {
@@ -124981,6 +125960,143 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
     function isInfraCapability(name2) {
       return infraNames.has(name2);
     }
+    var INFRA_NAMES = new Set(INFRA_CAPABILITIES.map((c) => c.name));
+    function isolatedBuiltinPhase(capabilities) {
+      return capabilities.some((c) => INFRA_NAMES.has(c.name)) ? "infra" : "consumer";
+    }
+    function partitionIsolatedBuiltinIds(ids, capabilitiesOf) {
+      const infra = [];
+      const consumers = [];
+      for (const id of ids) if (isolatedBuiltinPhase(capabilitiesOf(id)) === "infra") infra.push(id);
+      else consumers.push(id);
+      return {
+        infra,
+        consumers
+      };
+    }
+    async function waitUntilReady(isReady, options) {
+      const deadline = Date.now() + options.timeoutMs;
+      for (; ; ) {
+        if (isReady()) return;
+        if (Date.now() >= deadline) throw new Error(`Timed out waiting for ${options.what}`);
+        await new Promise((resolve) => {
+          setTimeout(resolve, options.intervalMs);
+        });
+      }
+    }
+    async function runHubAddonBoot(steps) {
+      await steps.spawnIsolatedInfra();
+      await steps.waitForDataStoreProvider();
+      await steps.bootInProcessInfra();
+      await steps.spawnForkedAddons();
+      await steps.bootInProcessConsumers();
+      await steps.spawnIsolatedConsumers();
+    }
+    function isRecord$1(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    function asBlob(value) {
+      return isRecord$1(value) ? value : {};
+    }
+    function unwrapValue(parsed) {
+      if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
+      return parsed.value;
+    }
+    async function loadPrefixed(door, collection, prefix) {
+      const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
+      const rows = await door.query({
+        collection,
+        ...range !== null ? { filter: { whereBetween: { id: [range.lo, range.hi] } } } : {}
+      });
+      const result = {};
+      for (const row of rows) {
+        if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+        if (!row.id.startsWith(prefix)) continue;
+        result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+      }
+      return result;
+    }
+    async function replacePrefixed(door, collection, prefix, values, wrap3) {
+      const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
+      if (range !== null) await door.deleteWhere({
+        collection,
+        filter: { whereBetween: { id: [range.lo, range.hi] } }
+      });
+      for (const [key, value] of Object.entries(values)) {
+        if (value === void 0) continue;
+        await door.set({
+          collection,
+          key: `${prefix}${key}`,
+          value: wrap3(key, value)
+        });
+      }
+    }
+    function createDoorSettingsView(addonId, door, sections) {
+      const addonPrefix = `${addonId}.`;
+      return {
+        async readAddonStore() {
+          return loadPrefixed(door, "addon-settings", addonPrefix);
+        },
+        async writeAddonStore(patch) {
+          await replacePrefixed(door, "addon-settings", addonPrefix, {
+            ...await loadPrefixed(door, "addon-settings", addonPrefix),
+            ...patch
+          }, (key, value) => ({
+            addonId,
+            key,
+            value
+          }));
+        },
+        async readDeviceStore(deviceId) {
+          return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
+        },
+        async writeDeviceStore(deviceId, patch) {
+          const scope = `${addonId}:${String(deviceId)}.`;
+          await replacePrefixed(door, "addon-device-settings", scope, {
+            ...await loadPrefixed(door, "addon-device-settings", scope),
+            ...patch
+          }, (key, value) => ({
+            addonId,
+            deviceId: String(deviceId),
+            key,
+            value
+          }));
+        },
+        async clearDeviceStore(deviceId) {
+          const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(`${addonId}:${String(deviceId)}.`);
+          if (range === null) return;
+          await door.deleteWhere({
+            collection: "addon-device-settings",
+            filter: { whereBetween: { id: [range.lo, range.hi] } }
+          });
+        },
+        async readDeviceRuntimeState(deviceId) {
+          return asBlob(await door.get({
+            collection: "device-runtime-state",
+            key: String(deviceId)
+          }));
+        },
+        async writeDeviceRuntimeState(deviceId, data) {
+          await door.set({
+            collection: "device-runtime-state",
+            key: String(deviceId),
+            value: data
+          });
+        },
+        async clearDeviceRuntimeState(deviceId) {
+          await door.delete({
+            collection: "device-runtime-state",
+            key: String(deviceId)
+          });
+        },
+        async getSection(section) {
+          return sections.getSection(section);
+        },
+        async setSection(section, patch) {
+          await sections.setSection(section, patch);
+        }
+      };
+    }
     var __create = Object.create;
     var __defProp = Object.defineProperty;
     var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -127460,6 +128576,7 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
       configPath;
       bootstrapConfig;
       settingsStore = null;
+      settingsDoor = null;
       runtimeState;
       runtimeStatePath;
       constructor(configPath) {
@@ -127480,6 +128597,14 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
       setSettingsStore(store) {
         this.settingsStore = store;
       }
+      /**
+      * Wire the async `settings-store` door. Used when the engine is isolated
+      * (no sync `ISettingsStore` handle on hub-main). {@link createSettingsView}
+      * prefers the sync store when both are present.
+      */
+      setSettingsDoor(door) {
+        this.settingsDoor = door;
+      }
       get(configPath) {
         return this.resolveConfigValue(configPath);
       }
@@ -127500,8 +128625,21 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
       * Throws if the settings store is not yet wired.
       */
       set(key, value) {
-        if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-        this.settingsStore.setSystem(key, value);
+        if (this.settingsStore !== null) {
+          this.settingsStore.setSystem(key, value);
+          return;
+        }
+        if (this.settingsDoor !== null) {
+          this.settingsDoor.set({
+            collection: "system-settings",
+            key,
+            value
+          }).catch((err) => {
+            console.error("[ConfigManager] isolated settings-store write failed", err);
+          });
+          return;
+        }
+        throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
       }
       /**
       * Bulk-read all keys that belong to a logical section.
@@ -127622,6 +128760,19 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
         this.settingsStore.clearDeviceRuntimeState(deviceId);
       }
       createSettingsView(addonId) {
+        if (this.settingsStore === null && this.settingsDoor !== null) {
+          const door = this.settingsDoor;
+          return createDoorSettingsView(addonId, door, {
+            getSection: (section) => this.getSection(section),
+            setSection: async (section, patch) => {
+              for (const [key, value] of Object.entries(patch)) await door.set({
+                collection: "system-settings",
+                key: `${section}.${key}`,
+                value
+              });
+            }
+          });
+        }
         const cm = this;
         return {
           async readAddonStore() {
@@ -199251,8 +200402,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
     exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
     exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
-    exports.CA_COMMON_NAME = CA_COMMON_NAME;
-    exports.CA_VALIDITY_DAYS = CA_VALIDITY_DAYS;
+    exports.CA_COMMON_NAME = require_lan_http_bind.CA_COMMON_NAME;
+    exports.CA_VALIDITY_DAYS = require_lan_http_bind.CA_VALIDITY_DAYS;
     exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
     exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
     exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -199269,6 +200420,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
     exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
     exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
+    exports.DEFAULT_LAN_HTTP_PORT = require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
     exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist10.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
     exports.DEVICE_STATUS_METHOD = require_dist10.DEVICE_STATUS_METHOD;
     exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -199299,7 +200451,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
     exports.IntegrationRegistry = IntegrationRegistry;
     exports.JobJournal = JobJournal;
-    exports.LEAF_RENEWAL_WINDOW_DAYS = LEAF_RENEWAL_WINDOW_DAYS;
+    exports.LEAF_RENEWAL_WINDOW_DAYS = require_lan_http_bind.LEAF_RENEWAL_WINDOW_DAYS;
     exports.LifecycleJobEngine = LifecycleJobEngine;
     exports.LifecycleStateMachine = LifecycleStateMachine;
     exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -199310,7 +200462,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.LogRingBuffer = LogRingBuffer;
     exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
     exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
-    exports.MAX_LEAF_VALIDITY_DAYS = MAX_LEAF_VALIDITY_DAYS;
+    exports.MAX_LEAF_VALIDITY_DAYS = require_lan_http_bind.MAX_LEAF_VALIDITY_DAYS;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
     exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -199336,7 +200488,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
-    exports.SERVER_AUTH_OID = SERVER_AUTH_OID;
+    exports.SERVER_AUTH_OID = require_lan_http_bind.SERVER_AUTH_OID;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
     exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -199360,6 +200512,9 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
     exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
     exports.addonSettingsCapability = require_dist10.addonSettingsCapability;
+    exports.allFamiliesListenHost = require_lan_http_bind.allFamiliesListenHost;
+    exports.applyLanHttp = require_lan_http_bind.applyLanHttp;
+    exports.bindPendingLanHttp = require_lan_http_bind.bindPendingLanHttp;
     exports.bootstrapSchema = bootstrapSchema;
     exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
     exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
@@ -199386,9 +200541,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.classifyAddonDir = classifyAddonDir;
     exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
     exports.clearPendingRestart = clearPendingRestart;
+    exports.closeLanHttp = require_lan_http_bind.closeLanHttp;
     exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
     exports.clusterSecretMatches = clusterSecretMatches;
-    exports.collectCertIdentity = collectCertIdentity;
+    exports.collectCertIdentity = require_lan_http_bind.collectCertIdentity;
     exports.collectModelFiles = require_file_data_plane.collectModelFiles;
     exports.contentTypeFor = require_file_data_plane.contentTypeFor;
     exports.copyDirRecursive = copyDirRecursive;
@@ -199400,6 +200556,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.createBroker = createBroker2;
     exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
     exports.createCoreCapService = createCoreCapService;
+    exports.createDoorSettingsView = createDoorSettingsView;
     exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
     exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;
     exports.createHubService = createHubService;
@@ -199454,8 +200611,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.ensurePython;
       }
     });
-    exports.ensureTlsCert = ensureTlsCert;
-    exports.evaluateExistingCert = evaluateExistingCert;
+    exports.ensureTlsCert = require_lan_http_bind.ensureTlsCert;
+    exports.evaluateExistingCert = require_lan_http_bind.evaluateExistingCert;
     exports.expandCapMethods = require_dist10.expandCapMethods;
     exports.fetchJson = require_file_data_plane.fetchJson;
     Object.defineProperty(exports, "findInPath", {
@@ -199519,21 +200676,30 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.isInfraCapability = isInfraCapability;
     exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
     exports.isSourceNewer = isSourceNewer;
-    exports.loadTlsCert = loadTlsCert;
+    exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
+    exports.loadTlsCert = require_lan_http_bind.loadTlsCert;
     exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
     exports.localProviderLink = require_manifest_python_deps.localProviderLink;
     exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
     exports.parseCapAction = require_manifest_python_deps.parseCapAction;
     exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
     exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
+    exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
     exports.proxyToUpstream = proxyToUpstream;
     exports.quarantineAddonResidue = quarantineAddonResidue;
+    exports.readExtraSans = require_lan_http_bind.readExtraSans;
+    exports.readLanHttpState = require_lan_http_bind.readLanHttpState;
     exports.readPendingRestart = readPendingRestart;
+    exports.readTlsAccessStatus = require_lan_http_bind.readTlsAccessStatus;
+    exports.readTlsMode = require_lan_http_bind.readTlsMode;
     exports.readinessKey = require_dist10.readinessKey;
     exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
+    exports.registerLanHttpHandler = require_lan_http_bind.registerLanHttpHandler;
+    exports.reissueTlsLeaf = require_lan_http_bind.reissueTlsLeaf;
     exports.resolveFilePath = require_file_data_plane.resolveFilePath;
     exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
     exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
+    exports.runHubAddonBoot = runHubAddonBoot;
     exports.runNpm = require_manifest_python_deps.runNpm;
     exports.scheduleSelfRestart = scheduleSelfRestart;
     exports.scopeKey = require_dist10.scopeKey;
@@ -199551,7 +200717,11 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
     exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
     exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
+    exports.validateUploadedTls = require_lan_http_bind.validateUploadedTls;
+    exports.waitUntilReady = waitUntilReady;
+    exports.writeExtraSans = require_lan_http_bind.writeExtraSans;
     exports.writePendingRestart = writePendingRestart;
+    exports.writeTlsMode = require_lan_http_bind.writeTlsMode;
   }
 });
 
@@ -238240,7 +239410,7 @@ var require_dist9 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_EY0GNjV9();
-    var require_sleep = require_sleep_C2XhJhkd();
+    var require_sleep = require_sleep_CizGYrCD();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -239766,6 +240936,16 @@ var require_dist9 = __commonJS({
       description: zod.z.string().optional(),
       icon: zod.z.string().optional()
     });
+    var CLASS_MAP_MACRO_TARGETS = [
+      "person",
+      "vehicle",
+      "animal",
+      "package"
+    ];
+    var ClassMapDefinitionSchema = zod.z.object({
+      mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
+      preserveOriginal: zod.z.boolean()
+    });
     var FORMAT_KEYS = [
       "onnx",
       "coreml",
@@ -239939,6 +241119,20 @@ var require_dist9 = __commonJS({
       */
       resolution: zod.z.number().int().positive().optional()
     });
+    var MODEL_PROVIDER_IDS = [
+      "camstack",
+      "frigate",
+      "scrypted",
+      "custom"
+    ];
+    var ModelProviderIdSchema = zod.z.enum(MODEL_PROVIDER_IDS);
+    function inferModelProvider(entry) {
+      if (entry.provider !== void 0) return entry.provider;
+      const haystack = `${entry.id} ${entry.description ?? ""}`;
+      if (/scrypted/i.test(haystack)) return "scrypted";
+      if (/frigate/i.test(haystack)) return "frigate";
+      return "custom";
+    }
     var ModelCatalogEntrySchema = zod.z.object({
       id: zod.z.string(),
       name: zod.z.string(),
@@ -240034,7 +241228,19 @@ var require_dist9 = __commonJS({
       * `id` stays the source of truth for resolution/download/persistence; grouping
       * is a presentation overlay resolved back to an `id`.
       */
-      group: ModelVariantGroupSchema.optional()
+      group: ModelVariantGroupSchema.optional(),
+      /**
+      * Catalog source for the pipeline stepper's provider-first picker. Absent on
+      * built-in CamStack entries (treated as `camstack`) and on registry rows
+      * persisted before this field existed (`inferModelProvider` fills those).
+      */
+      provider: ModelProviderIdSchema.optional(),
+      /**
+      * Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+      * applies (Frigate / COCO public catalog). Set on a custom model whose raw
+      * labels already ARE the CamStack macros (Scrypted identity map).
+      */
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
       format: zod.z.literal("openvino"),
@@ -240063,7 +241269,8 @@ var require_dist9 = __commonJS({
         "ocr",
         "segmentation"
       ]),
-      faceAlignment: zod.z.boolean().optional()
+      faceAlignment: zod.z.boolean().optional(),
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertArtifactSchema = zod.z.object({
       format: zod.z.enum(MODEL_FORMATS),
@@ -247891,14 +249098,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     });
     var NC_AUDIO_DBFS_FLOOR = -96;
     var NcAudioConditionSchema = zod.z.object({
-      /** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+      /** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
       labels: zod.z.array(zod.z.string().min(1)).min(1).optional(),
       /** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
       dbThreshold: zod.z.number().min(-96).max(0).optional(),
       /** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
       hitPercent: zod.z.number().int().min(1).max(100).default(60),
       /** LEVEL MODE ONLY: length of the sampling window in seconds. */
-      samplingSeconds: zod.z.number().int().min(1).max(300).default(10)
+      samplingSeconds: zod.z.number().int().min(1).max(300).default(10),
+      /**
+      * LABEL MODE: how many labelled frames must land inside
+      * {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+      * Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+      */
+      confirmHits: zod.z.number().int().min(1).max(20).optional(),
+      /** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+      confirmWindowSec: zod.z.number().int().min(1).max(60).optional()
     });
     var NcCrossingSchema = zod.z.enum([
       "enter",
@@ -250158,6 +251373,46 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Cursor for the next page, or null when this page is the last. */
       nextCursor: zod.z.string().nullable()
     });
+    var LIST_GROUPS_DEFAULT_LIMIT = 40;
+    var LIST_GROUPS_MAX_LIMIT = 100;
+    var AnalyticsGroupRecordSchema = zod.z.object({
+      id: zod.z.string(),
+      deviceId: zod.z.number().int(),
+      openedAt: zod.z.number().int(),
+      closedAt: zod.z.number().int(),
+      timestamp: zod.z.number().int(),
+      memberCount: zod.z.number().int(),
+      memberTrackIds: zod.z.array(zod.z.string()).readonly(),
+      className: zod.z.string(),
+      classes: zod.z.array(zod.z.string()).readonly(),
+      /** Relative event-media path, or null when the group has no picture yet. */
+      mediaUrl: zod.z.string().nullable(),
+      singleton: zod.z.boolean()
+    });
+    var AnalyticsGroupMemberSchema = zod.z.object({
+      trackId: zod.z.string(),
+      deviceId: zod.z.number().int(),
+      className: zod.z.string(),
+      firstSeen: zod.z.number().int(),
+      lastSeen: zod.z.number().int(),
+      mediaUrl: zod.z.string().nullable()
+    });
+    var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: zod.z.array(AnalyticsGroupMemberSchema).readonly() });
+    var ListGroupsQueryInput = zod.z.object({
+      /** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+      deviceIds: zod.z.array(zod.z.number()),
+      /** Window lower bound on `closedAt` (inclusive). */
+      since: zod.z.number().optional(),
+      /** Window upper bound on `openedAt` (inclusive). */
+      until: zod.z.number().optional(),
+      limit: zod.z.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+      /** Opaque continuation cursor from a previous page's `nextCursor`. */
+      cursor: zod.z.string().optional()
+    });
+    var ListGroupsPageSchema = zod.z.object({
+      groups: zod.z.array(AnalyticsGroupRecordSchema).readonly(),
+      nextCursor: zod.z.string().nullable()
+    });
     var KeyEventQueryInput = zod.z.object({
       deviceId: zod.z.number(),
       /** Window lower bound (track firstSeen ≥ since). */
@@ -250233,7 +251488,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
       plates: zod.z.number().int(),
       /** Per-track CLIP search vectors removed (best-effort). */
-      embeddings: zod.z.number().int()
+      embeddings: zod.z.number().int(),
+      /** Group membership + group rows removed with their last member (best-effort). */
+      groups: zod.z.number().int()
     });
     var DiskReconcileCountsSchema = zod.z.object({
       mediaDropped: zod.z.number().int(),
@@ -250375,6 +251632,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * are not included (same contract as `listTracks`).
         */
         listRecentTracks: require_sleep.method(RecentTracksQueryInput, RecentTracksPageSchema),
+        /**
+        * Batched co-moving group listing — the Groups feed. Same merge/cursor
+        * contract as {@link listRecentTracks}. A group is a sealed partition of
+        * one session; `getGroup` is the detail with members.
+        */
+        listGroups: require_sleep.method(ListGroupsQueryInput, ListGroupsPageSchema),
+        getGroup: require_sleep.method(zod.z.object({
+          deviceId: zod.z.number(),
+          groupId: zod.z.string().min(1)
+        }), AnalyticsGroupDetailSchema.nullable()),
         clearTracks: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
           auth: "admin"
@@ -250963,6 +252230,33 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         h: zod.z.number()
       })
     });
+    zod.z.object({
+      crop: zod.z.object({
+        left: zod.z.number(),
+        top: zod.z.number(),
+        width: zod.z.number().positive(),
+        height: zod.z.number().positive()
+      }).optional(),
+      content: zod.z.object({
+        width: zod.z.number().int().positive(),
+        height: zod.z.number().int().positive()
+      }),
+      fit: zod.z.enum(["stretch", "contain"]),
+      format: zod.z.enum([
+        "rgb",
+        "gray",
+        "jpeg"
+      ])
+    });
+    var FrameRefSchema = zod.z.object({
+      registryId: zod.z.string().min(1),
+      id: zod.z.string().min(1),
+      width: zod.z.number().int().positive(),
+      height: zod.z.number().int().positive(),
+      format: zod.z.enum(["rgb", "gray"]),
+      timestamp: zod.z.number(),
+      capturedAt: zod.z.number().optional()
+    });
     var ModelFormatSchema$1 = zod.z.enum([
       "onnx",
       "coreml",
@@ -251029,7 +252323,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         sizeMB: zod.z.number()
       })),
       group: ModelVariantGroupSchema.optional(),
-      legacy: zod.z.boolean().optional()
+      legacy: zod.z.boolean().optional(),
+      provider: ModelProviderIdSchema.optional()
     });
     var ConfigFieldBridge = zod.z.custom();
     var PipelineAddonSchemaSchema = zod.z.object({
@@ -251262,7 +252557,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * legacy call shape used by existing benchmark code; once all
         * callers pass it explicitly we make it required.
         *
-        * Exactly one of `frame`, `frameHandle`, `imageBase64`,
+        * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
         * `referenceImage` must be provided:
         *  - `frame`: runtime dispatch path (runner → decoded broker frame).
         *    Carries the raw buffer, dimensions, and format; the executor
@@ -251284,6 +252579,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           steps: zod.z.array(PipelineStepInputSchema).min(1),
           frame: FrameInputSchema.optional(),
           /**
+          * Process-local lazy frame. Valid only when caller and provider resolve
+          * in the same execution-group process; split/cross-node callers use
+          * `frame`/`image` inline compatibility instead.
+          */
+          frameRef: FrameRefSchema.optional(),
+          /**
           * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
           * the decoded pixels live in. One more member of the one-of
           * frame/frameHandle/image/imageBase64/referenceImage group.
@@ -251586,7 +252887,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Which source served this crop, so a quality-sensitive consumer (the native
       * `keyFrame`) can reject a degraded fallback:
       * - `native` — cut from the decode worker's retained NATIVE surface (the
-      *   quality path).
+      *   quality path). A subject-tile serve is also native-resolution and stays
+      *   `native` here: the public enum cannot name `tile` without a breaking cap
+      *   change. Runner telemetry distinguishes lease vs tile via `source` on the
+      *   internal crop result (`nativeHits` vs `tileHits`).
       * - `ram-fullframe` — the native surface MISSED but the request was full-frame,
       *   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
       *   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -252089,12 +253393,41 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         cpuCores: zod.z.number().optional()
       })
     });
+    var FrameLazyCountersSchema = zod.z.object({
+      framesDecoded: zod.z.number(),
+      framesAdmitted: zod.z.number(),
+      framesDroppedPixelFree: zod.z.number(),
+      viewsMaterialized: zod.z.number(),
+      viewsSkipped: zod.z.number(),
+      workerToRunnerBytes: zod.z.number(),
+      runnerToPoolRawBytes: zod.z.number(),
+      runnerToPoolJpegBytes: zod.z.number(),
+      onDemandFullFrameRequests: zod.z.number(),
+      onDemandCropRequests: zod.z.number(),
+      nativeHits: zod.z.number(),
+      nativeMisses: zod.z.number(),
+      tileHits: zod.z.number(),
+      tileMisses: zod.z.number(),
+      fallbackHits: zod.z.number(),
+      fallbackMisses: zod.z.number(),
+      retainedWritesAvoided: zod.z.number(),
+      residentRefs: zod.z.number(),
+      residentBytes: zod.z.number(),
+      releases: zod.z.number(),
+      evictions: zod.z.number(),
+      staleMisses: zod.z.number()
+    });
+    var FrameLazyMetricsSchema = zod.z.object({
+      node: FrameLazyCountersSchema,
+      cameras: zod.z.array(FrameLazyCountersSchema.extend({ deviceId: zod.z.number() }))
+    });
     var RunnerLocalMetricsSchema = zod.z.object({
       nodeId: zod.z.string(),
       activeCameras: zod.z.number(),
       throttledCameras: zod.z.number(),
       avgInferenceTimeMs: zod.z.number(),
-      queueDepth: zod.z.number()
+      queueDepth: zod.z.number(),
+      frameLazy: FrameLazyMetricsSchema.optional()
     });
     var pipelineRunnerCapability = {
       name: "pipeline-runner",
@@ -253900,6 +255233,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         endDownload: require_sleep.method(EndDownloadInputSchema, zod.z.void(), { kind: "mutation" })
       }
     };
+    var ProfileSettingsSchemaBridge = zod.z.unknown().nullable();
+    var ProfileSettingsBagSchema = zod.z.record(zod.z.string(), zod.z.unknown());
     var TerminalSessionInfoSchema = zod.z.object({
       /** Opaque session id minted by the provider on `openSession`. */
       sessionId: zod.z.string(),
@@ -253915,7 +255250,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var TerminalProfileInfoSchema = zod.z.object({
       profileId: zod.z.string(),
       label: zod.z.string(),
-      description: zod.z.string().optional()
+      description: zod.z.string().optional(),
+      /** Spawn defaults the instance form copies on create. */
+      executable: zod.z.string().optional(),
+      args: zod.z.array(zod.z.string()).readonly().optional(),
+      cwd: zod.z.string().optional(),
+      environment: zod.z.array(zod.z.string()).readonly().optional(),
+      /** ConfigUISchema for instance knobs, or null when the profile has none. */
+      settingsSchema: ProfileSettingsSchemaBridge.optional()
     });
     var TerminalInstanceInfoSchema = zod.z.object({
       instanceId: zod.z.string(),
@@ -253924,7 +255266,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       profileId: zod.z.string(),
       profileLabel: zod.z.string(),
       name: zod.z.string(),
-      enabled: zod.z.boolean()
+      enabled: zod.z.boolean(),
+      executable: zod.z.string(),
+      args: zod.z.array(zod.z.string()).readonly(),
+      cwd: zod.z.string(),
+      environment: zod.z.array(zod.z.string()).readonly(),
+      profileSettings: ProfileSettingsBagSchema
     });
     var TerminalLegacyCameraSchema = zod.z.object({
       stableId: zod.z.string(),
@@ -253963,7 +255310,24 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         createInstance: require_sleep.method(zod.z.object({
           targetNodeId: zod.z.string().min(1),
           profileId: zod.z.string().min(1),
-          name: zod.z.string().trim().min(1).max(160).optional()
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
+        }), TerminalInstanceInfoSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        updateInstance: require_sleep.method(zod.z.object({
+          instanceId: zod.z.string().min(1),
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
         }), TerminalInstanceInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -253998,7 +255362,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         openSession: require_sleep.method(zod.z.object({
           profileId: zod.z.string(),
           cols: zod.z.number().int().positive(),
-          rows: zod.z.number().int().positive()
+          rows: zod.z.number().int().positive(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
         }), TerminalSessionInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -257724,6 +259092,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** What the ranking currently resolves to (null when nothing is reachable). */
       resolved: zod.z.string().nullable()
     });
+    var ViewerEndpointsSchema = zod.z.object({
+      /** The operator's explicit race set, or empty for AUTO. */
+      baseUrls: zod.z.array(zod.z.string()).readonly(),
+      /** What the ranking currently resolves to (may be empty if nothing is up). */
+      resolved: zod.z.array(zod.z.string()).readonly()
+    });
     var AllowedAddressesSchema = zod.z.object({
       /**
       * Allowlist of interface addresses operators have explicitly opted
@@ -257733,6 +259107,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       addresses: zod.z.array(zod.z.string()).readonly()
     });
+    var TlsStatusSchema = zod.z.object({
+      mode: zod.z.enum([
+        "generated",
+        "uploaded",
+        "disabled"
+      ]),
+      leafFingerprintSha256: zod.z.string().nullable(),
+      caFingerprintSha256: zod.z.string().nullable(),
+      validTo: zod.z.string().nullable(),
+      sans: zod.z.array(zod.z.string()),
+      caCertPem: zod.z.string().nullable(),
+      reissueError: zod.z.string().nullable(),
+      restartRequired: zod.z.boolean()
+    });
     var localNetworkCapability = {
       name: "local-network",
       scope: "system",
@@ -257752,13 +259140,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         getPreferred: require_sleep.method(zod.z.void(), PreferredSchema),
         /**
-        * Ordered candidate base URLs the SDK should try on connect.
-        * Includes LAN IPs (one per non-internal interface), the public
-        * tunnel hostname (when active), and loopback as a last-resort
-        * fallback. Filterable by `includeLoopback` / `ipv4Only`.
-        * Honours `getAllowedAddresses()` when set — addresses outside
-        * the allowlist are dropped (the public tunnel + loopback are
-        * always included as escape hatches).
+        * Ordered candidate base URLs (the palette the Network tab shows).
+        * Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+        * joined. Loopback is off by default. The SDK races the subset from
+        * `getViewerEndpoints`, not this full list — IPv6 stays here because
+        * WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+        * `getAllowedAddresses()` when set — addresses outside the allowlist
+        * are dropped (the public tunnel is still included as an escape hatch).
         *
         * **The port is the hub's, not the caller's** (D62 — a function's fact
         * belongs to whoever already owns it). This method used to take a `port`
@@ -257789,10 +259177,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           */
           port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-          *  candidate. Default `true`. */
+          *  candidate. Default `false` — loopback is not a client route. */
           includeLoopback: zod.z.boolean().optional(),
-          /** Skip IPv6 entries. Some legacy clients can't parse them.
-          *  Default `false`. */
+          /** Skip IPv6 entries. Default `false` — the palette includes stable
+          *  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+          *  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
           ipv4Only: zod.z.boolean().optional(),
           /** Scheme to emit for LAN/loopback URLs. Default `'http'`.
           *  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -257821,6 +259210,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         setNotificationEndpoint: require_sleep.method(zod.z.object({ baseUrl: zod.z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
         /**
+        * The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+        * means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+        * never mesh, never loopback. `resolved` is that set (or the operator's
+        * explicit subset) as it stands right now.
+        */
+        getViewerEndpoints: require_sleep.method(zod.z.void(), ViewerEndpointsSchema),
+        /**
+        * Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+        * verbatim (not indices) so a temporarily-down tunnel is not silently
+        * dropped from the operator's choice.
+        */
+        setViewerEndpoints: require_sleep.method(zod.z.object({ baseUrls: zod.z.array(zod.z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+        /**
         * Read the operator's allowlist. Empty = "auto" (no filter). Used
         * by the admin UI's address selector to seed its checkbox state.
         */
@@ -257838,7 +259240,34 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * when the operator wants to wipe their manual edits and start
         * over from the auto-detected best matches.
         */
-        resetAllowlistToBestMatch: require_sleep.method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" })
+        resetAllowlistToBestMatch: require_sleep.method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+        /**
+        * Live TLS material for the Network → Local access certificate card.
+        * LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+        * a second store — this query is status, not configuration.
+        */
+        getTlsStatus: require_sleep.method(zod.z.void(), TlsStatusSchema),
+        /** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+        regenerateCertificate: require_sleep.method(zod.z.object({ reason: zod.z.string().optional() }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** Replace the served material with operator-supplied PEMs. */
+        uploadCertificate: require_sleep.method(zod.z.object({
+          certPem: zod.z.string().min(1),
+          keyPem: zod.z.string().min(1),
+          caPem: zod.z.string().optional()
+        }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** The local CA PEM, or empty when there is none to download. */
+        downloadCa: require_sleep.method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
+        /** Drop uploaded material and return to the generated local CA. */
+        revertToGeneratedCertificate: require_sleep.method(zod.z.void(), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        })
       },
       /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
       mount: { kind: "hub-only" }
@@ -259373,7 +260802,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       plateBbox: BoundingBoxSchema.optional(),
       /** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
       keyFrameMediaKey: zod.z.string().optional(),
-      base64: zod.z.string().optional()
+      base64: zod.z.string().optional(),
+      /**
+      * Same crop as a data-plane URL. `getPlateByTrack` returns this and
+      * never inlines JPEG; `listPlates` still inlines for the admin-ui.
+      */
+      cropUrl: zod.z.string().optional()
     });
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
@@ -268127,6 +269561,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "localNetwork.downloadCa": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.getAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -268151,18 +269591,42 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "localNetwork.getTlsStatus": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
+      "localNetwork.getViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.list": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "localNetwork.regenerateCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.resetAllowlistToBestMatch": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "delete"
       },
+      "localNetwork.revertToGeneratedCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.setAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -268175,6 +269639,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "localNetwork.setViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "localNetwork.uploadCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "lockControl.lock": {
         capName: "lock-control",
         capScope: "device",
@@ -268973,6 +270449,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getGroup": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getKeyEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -269057,6 +270539,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listGroups": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listOpsLog": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -271055,6 +272543,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "terminalSession.updateInstance": {
+        capName: "terminal-session",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "terminalSession.writeInput": {
         capName: "terminal-session",
         capScope: "system",
@@ -272722,6 +274216,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getGroup": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.getKeyEvents": [{
         name: "deviceId",
         form: "single",
@@ -272777,6 +274276,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listGroups": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "pipelineAnalytics.listOpsLog": [{
         name: "deviceId",
         form: "single",
@@ -274313,9 +275817,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           getConnectionEndpoints: (input) => dispatch("localNetwork", "getConnectionEndpoints", "query", input),
           getNotificationEndpoint: (input) => dispatch("localNetwork", "getNotificationEndpoint", "query", input),
           setNotificationEndpoint: (input) => dispatch("localNetwork", "setNotificationEndpoint", "mutation", input),
+          getViewerEndpoints: (input) => dispatch("localNetwork", "getViewerEndpoints", "query", input),
+          setViewerEndpoints: (input) => dispatch("localNetwork", "setViewerEndpoints", "mutation", input),
           getAllowedAddresses: (input) => dispatch("localNetwork", "getAllowedAddresses", "query", input),
           setAllowedAddresses: (input) => dispatch("localNetwork", "setAllowedAddresses", "mutation", input),
-          resetAllowlistToBestMatch: (input) => dispatch("localNetwork", "resetAllowlistToBestMatch", "mutation", input)
+          resetAllowlistToBestMatch: (input) => dispatch("localNetwork", "resetAllowlistToBestMatch", "mutation", input),
+          getTlsStatus: (input) => dispatch("localNetwork", "getTlsStatus", "query", input),
+          regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
+          uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
+          downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+          revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
         },
         meshNetwork: {
           getStatus: (input) => dispatch("meshNetwork", "getStatus", "query", input),
@@ -274597,6 +276108,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           listProfiles: (input) => dispatch("terminalSession", "listProfiles", "query", input),
           listInstances: (input) => dispatch("terminalSession", "listInstances", "query", input),
           createInstance: (input) => dispatch("terminalSession", "createInstance", "mutation", input),
+          updateInstance: (input) => dispatch("terminalSession", "updateInstance", "mutation", input),
           deleteInstance: (input) => dispatch("terminalSession", "deleteInstance", "mutation", input),
           setInstanceEnabled: (input) => dispatch("terminalSession", "setInstanceEnabled", "mutation", input),
           listLegacyCameras: (input) => dispatch("terminalSession", "listLegacyCameras", "query", input),
@@ -274655,6 +276167,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var NC_AUDIO_HIT_PERCENT_MAX = 100;
     var NC_AUDIO_SAMPLING_MIN_SEC = 1;
     var NC_AUDIO_SAMPLING_MAX_SEC = 300;
+    var NC_AUDIO_CONFIRM_HITS_DEFAULT = 2;
+    var NC_AUDIO_CONFIRM_WINDOW_SEC_DEFAULT = 5;
+    var NC_AUDIO_CONFIRM_HITS_MIN = 1;
+    var NC_AUDIO_CONFIRM_HITS_MAX = 20;
+    var NC_AUDIO_CONFIRM_WINDOW_MIN_SEC = 1;
+    var NC_AUDIO_CONFIRM_WINDOW_MAX_SEC = 60;
     var NC_AUDIO_DEFAULTS = {
       hitPercent: 60,
       samplingSeconds: 10
@@ -274691,7 +276209,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         ...labels !== void 0 ? { labels: [...labels] } : {},
         ...dbThreshold !== void 0 ? { dbThreshold: clampInt(dbThreshold, NC_AUDIO_DB_MIN, 0) } : {},
         hitPercent: clampInt(patch.hitPercent ?? base.hitPercent, 1, 100),
-        samplingSeconds: clampInt(patch.samplingSeconds ?? base.samplingSeconds, 1, 300)
+        samplingSeconds: clampInt(patch.samplingSeconds ?? base.samplingSeconds, 1, 300),
+        ...(() => {
+          const hits = has(patch, "confirmHits") ? patch.confirmHits : base.confirmHits;
+          const windowSec = has(patch, "confirmWindowSec") ? patch.confirmWindowSec : base.confirmWindowSec;
+          return {
+            ...hits !== void 0 ? { confirmHits: clampInt(hits, 1, 20) } : {},
+            ...windowSec !== void 0 ? { confirmWindowSec: clampInt(windowSec, 1, 60) } : {}
+          };
+        })()
       };
     }
     function audioLabelChoices(taxonomy, selected) {
@@ -275511,6 +277037,58 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       const chosen = models[stepId];
       return chosen !== void 0 && chosen !== "" ? chosen : step2.defaultModelId;
     }
+    var DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = 24;
+    var CLUSTER_STEP_SETTING_FIELDS = [{
+      stepId: "face-embedding",
+      key: "minLandmarkFaceSize",
+      label: "Min face size for recognition (detection px)",
+      description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node \u2014 the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+      type: "slider",
+      min: 0,
+      max: 64,
+      step: 2,
+      default: 24
+    }];
+    function clusterStepSettingKey(stepId, fieldKey) {
+      return `clusterStepSetting:${stepId}:${fieldKey}`;
+    }
+    function clusterStepSettingFieldsFor(stepId) {
+      return CLUSTER_STEP_SETTING_FIELDS.filter((field) => field.stepId === stepId);
+    }
+    var ClusterSettingNumberSchema = zod.z.number().finite();
+    function readClusterStepSettings(config) {
+      const out = {};
+      for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+        const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+        const value = parsed.success ? parsed.data : field.default;
+        const existing = out[field.stepId] ?? {};
+        out[field.stepId] = {
+          ...existing,
+          [field.key]: value
+        };
+      }
+      return out;
+    }
+    var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
+    function pickClusterStepSettings(view) {
+      if (view === null) return DEFAULT_CLUSTER_STEP_SETTINGS;
+      const flat = {};
+      const wanted = new Set(CLUSTER_STEP_SETTING_FIELDS.map((field) => clusterStepSettingKey(field.stepId, field.key)));
+      for (const section of view.sections) for (const entry of section.fields) {
+        if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+        if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+      }
+      return readClusterStepSettings(flat);
+    }
+    function overlayClusterStepSettings(stepId, deviceSettings, cluster) {
+      const overlay = cluster[stepId];
+      if (overlay === void 0 || Object.keys(overlay).length === 0) return deviceSettings === void 0 ? void 0 : { ...deviceSettings };
+      if (deviceSettings === void 0) return { ...overlay };
+      return {
+        ...deviceSettings,
+        ...overlay
+      };
+    }
     var DETAIL_CROP_SECTION_ID = "detail-crop";
     var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
     var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
@@ -277223,6 +278801,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.AlertSourceSchema = AlertSourceSchema;
     exports.AlertStatusSchema = AlertStatusSchema;
     exports.AmbientLightSensorStatusSchema = AmbientLightSensorStatusSchema;
+    exports.AnalyticsGroupDetailSchema = AnalyticsGroupDetailSchema;
+    exports.AnalyticsGroupMemberSchema = AnalyticsGroupMemberSchema;
+    exports.AnalyticsGroupRecordSchema = AnalyticsGroupRecordSchema;
     exports.ApiKeyRecordSchema = ApiKeyRecordSchema;
     exports.ApiKeySummarySchema = ApiKeySummarySchema;
     exports.ArchiveEntrySchema = ArchiveEntrySchema;
@@ -277299,8 +278880,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CAP_NAMES_WITH_STATUS = CAP_NAMES_WITH_STATUS;
     exports.CAP_NODE_PIN_CONTEXT_KEY = require_sleep.CAP_NODE_PIN_CONTEXT_KEY;
     exports.CAP_PROVIDER_KIND_MAP = CAP_PROVIDER_KIND_MAP;
+    exports.CLASS_MAP_MACRO_TARGETS = CLASS_MAP_MACRO_TARGETS;
     exports.CLUSTER_MODEL_SCOPED_STEPS = CLUSTER_MODEL_SCOPED_STEPS;
     exports.CLUSTER_MODEL_SECTION_ID = CLUSTER_MODEL_SECTION_ID;
+    exports.CLUSTER_STEP_SETTING_FIELDS = CLUSTER_STEP_SETTING_FIELDS;
     exports.COCO_80_LABELS = COCO_80_LABELS;
     exports.COCO_TO_MACRO = COCO_TO_MACRO;
     exports.CONNECTION_TEST_TIMEOUT_MS = CONNECTION_TEST_TIMEOUT_MS;
@@ -277344,6 +278927,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CapabilityBindingsSchema = CapabilityBindingsSchema;
     exports.CarbonMonoxideStatusSchema = CarbonMonoxideStatusSchema;
     exports.ChargingStatus = require_sleep.ChargingStatus;
+    exports.ClassMapDefinitionSchema = ClassMapDefinitionSchema;
     exports.ClientNetworkStatsSchema = ClientNetworkStatsSchema;
     exports.ClimateControlStatusSchema = ClimateControlStatusSchema;
     exports.ClipPlaybackSchema = ClipPlaybackSchema;
@@ -277389,11 +278973,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEFAULT_ADDON_PLACEMENT = DEFAULT_ADDON_PLACEMENT;
     exports.DEFAULT_AUDIO_ANALYZER_CONFIG = DEFAULT_AUDIO_ANALYZER_CONFIG;
     exports.DEFAULT_CLUSTER_STEP_MODELS = DEFAULT_CLUSTER_STEP_MODELS;
+    exports.DEFAULT_CLUSTER_STEP_SETTINGS = DEFAULT_CLUSTER_STEP_SETTINGS;
     exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
     exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
     exports.DEFAULT_EVENTS_BAND_BUFFER_SEC = DEFAULT_EVENTS_BAND_BUFFER_SEC;
     exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
     exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
+    exports.DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = DEFAULT_MIN_LANDMARK_FACE_SIZE_PX;
     exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
     exports.DEFAULT_POOL_MEMORY_POLICY = DEFAULT_POOL_MEMORY_POLICY;
     exports.DEFAULT_RECORDING_PROFILES = DEFAULT_RECORDING_PROFILES;
@@ -277517,6 +279103,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.FrameHandleFormatSchema = require_sleep.FrameHandleFormatSchema;
     exports.FrameHandleSchema = require_sleep.FrameHandleSchema;
     exports.FrameInputSchema = FrameInputSchema;
+    exports.FrameLazyCountersSchema = FrameLazyCountersSchema;
+    exports.FrameLazyMetricsSchema = FrameLazyMetricsSchema;
     exports.GasStatusSchema = GasStatusSchema;
     exports.GetStreamWithCodecInputSchema = GetStreamWithCodecInputSchema;
     exports.GlobalMetricsSchema = GlobalMetricsSchema;
@@ -277559,6 +279147,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.LawnMowerControlStatusSchema = LawnMowerControlStatusSchema;
     exports.LinkedDeviceSchema = LinkedDeviceSchema;
     exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
+    exports.ListGroupsPageSchema = ListGroupsPageSchema;
+    exports.ListGroupsQueryInput = ListGroupsQueryInput;
     exports.LlmDefaultSchema = LlmDefaultSchema;
     exports.LlmDefaultSelectorSchema = LlmDefaultSelectorSchema;
     exports.LlmDownloadProgressSchema = LlmDownloadProgressSchema;
@@ -277602,6 +279192,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.METHOD_ACCESS_MAP = METHOD_ACCESS_MAP;
     exports.METHOD_DEVICE_SELECTORS = METHOD_DEVICE_SELECTORS;
     exports.MODEL_FORMATS = MODEL_FORMATS;
+    exports.MODEL_PROVIDER_IDS = MODEL_PROVIDER_IDS;
     exports.MOTION_TRIGGER_FEATURE = MOTION_TRIGGER_FEATURE;
     exports.ManagedModelCatalogEntrySchema = ManagedModelCatalogEntrySchema;
     exports.ManagedModelExtraFileSchema = ManagedModelExtraFileSchema;
@@ -277632,6 +279223,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ModelExtraFileSchema = ModelExtraFileSchema;
     exports.ModelFormatEntrySchema = ModelFormatEntrySchema;
     exports.ModelFormatsSchema = ModelFormatsSchema;
+    exports.ModelProviderIdSchema = ModelProviderIdSchema;
     exports.ModelSubstitutionSchema = ModelSubstitutionSchema;
     exports.ModelVariantGroupSchema = ModelVariantGroupSchema;
     exports.MotionAnalysisResultSchema = MotionAnalysisResultSchema;
@@ -277661,6 +279253,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
     exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
     exports.NC_ALARM_SYSTEM_EVENT_KINDS = NC_ALARM_SYSTEM_EVENT_KINDS;
+    exports.NC_AUDIO_CONFIRM_HITS_DEFAULT = NC_AUDIO_CONFIRM_HITS_DEFAULT;
+    exports.NC_AUDIO_CONFIRM_HITS_MAX = NC_AUDIO_CONFIRM_HITS_MAX;
+    exports.NC_AUDIO_CONFIRM_HITS_MIN = NC_AUDIO_CONFIRM_HITS_MIN;
+    exports.NC_AUDIO_CONFIRM_WINDOW_MAX_SEC = NC_AUDIO_CONFIRM_WINDOW_MAX_SEC;
+    exports.NC_AUDIO_CONFIRM_WINDOW_MIN_SEC = NC_AUDIO_CONFIRM_WINDOW_MIN_SEC;
+    exports.NC_AUDIO_CONFIRM_WINDOW_SEC_DEFAULT = NC_AUDIO_CONFIRM_WINDOW_SEC_DEFAULT;
     exports.NC_AUDIO_DBFS_FLOOR = NC_AUDIO_DBFS_FLOOR;
     exports.NC_AUDIO_DB_MAX = NC_AUDIO_DB_MAX;
     exports.NC_AUDIO_DB_MIN = NC_AUDIO_DB_MIN;
@@ -278171,6 +279769,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.classifyStreams = classifyStreams;
     exports.climateControlCapability = climateControlCapability;
     exports.clusterModelSettingKey = clusterModelSettingKey;
+    exports.clusterStepSettingFieldsFor = clusterStepSettingFieldsFor;
+    exports.clusterStepSettingKey = clusterStepSettingKey;
     exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
     exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
     exports.colorCapability = colorCapability;
@@ -278197,6 +279797,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.createDeviceProxy = require_sleep.createDeviceProxy;
     exports.createDurableState = require_sleep.createDurableState;
     exports.createEvent = require_sleep.createEvent;
+    exports.createEventBusSliceSource = require_sleep.createEventBusSliceSource;
     exports.createExpressionScope = createExpressionScope;
     exports.createHwAccelCache = createHwAccelCache;
     exports.createLazyTrpcSource = require_sleep.createLazyTrpcSource;
@@ -278279,6 +279880,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.hydrateSchema = require_sleep.hydrateSchema;
     exports.imageCapability = imageCapability;
     exports.imageSettingsCapability = imageSettingsCapability;
+    exports.inferModelProvider = inferModelProvider;
     exports.initialPoolMemoryState = initialPoolMemoryState;
     exports.integrationsCapability = integrationsCapability;
     exports.intercomCapability = intercomCapability;
@@ -278361,6 +279963,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.objectInputDeclaresAddonId = objectInputDeclaresAddonId;
     exports.osdCapability = osdCapability;
     exports.osdManagerCapability = osdManagerCapability;
+    exports.overlayClusterStepSettings = overlayClusterStepSettings;
     exports.parseCameraStreamConfig = parseCameraStreamConfig;
     exports.parseExpression = parseExpression;
     exports.parseJsonArray = require_sleep.parseJsonArray;
@@ -278374,6 +279977,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.petFeederCapability = petFeederCapability;
     exports.pickAccessoryControl = pickAccessoryControl;
     exports.pickClusterStepModels = pickClusterStepModels;
+    exports.pickClusterStepSettings = pickClusterStepSettings;
     exports.pickDetailCropConvention = pickDetailCropConvention;
     exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
     exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
@@ -278398,6 +280002,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ptzCapability = ptzCapability;
     exports.pythonScriptForBackend = pythonScriptForBackend;
     exports.readClusterStepModels = readClusterStepModels;
+    exports.readClusterStepSettings = readClusterStepSettings;
     exports.readDetailCropConvention = readDetailCropConvention;
     exports.readDeviceStateFrom = readDeviceStateFrom;
     exports.readNativeLeaseOverride = readNativeLeaseOverride;
@@ -394926,18 +396531,26 @@ var require_session_cookie = __commonJS({
     exports.isEmbedRedirectTarget = isEmbedRedirectTarget;
     exports.isSessionGradeJwtPayload = isSessionGradeJwtPayload;
     exports.SESSION_COOKIE = "camstack_session";
-    function buildSessionCookie(token2, ttlSec) {
+    function buildSessionCookie(token2, ttlSec, opts = {}) {
       return {
         name: exports.SESSION_COOKIE,
         value: token2,
-        options: { httpOnly: true, sameSite: "lax", secure: true, path: "/", maxAge: ttlSec }
+        options: {
+          httpOnly: true,
+          sameSite: "lax",
+          // Secure cookies are invisible on the LAN HTTP sibling (plain http://).
+          // Default stays true so HTTPS callers do not regress.
+          secure: opts.secure ?? true,
+          path: "/",
+          maxAge: ttlSec
+        }
       };
     }
-    function clearSessionCookie() {
+    function clearSessionCookie(opts = {}) {
       return {
         name: exports.SESSION_COOKIE,
         value: "",
-        options: { httpOnly: true, sameSite: "lax", secure: true, path: "/", maxAge: 0 }
+        options: { httpOnly: true, sameSite: "lax", secure: opts.secure ?? true, path: "/", maxAge: 0 }
       };
     }
     function readSessionCookieFromHeader(header) {
@@ -395102,6 +396715,25 @@ var require_health_routes = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/health/adaptive-probe.routes.js
+var require_adaptive_probe_routes = __commonJS({
+  "../../server/backend/dist/api/health/adaptive-probe.routes.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ADAPTIVE_PROBE_BYTES = void 0;
+    exports.registerAdaptiveProbeRoute = registerAdaptiveProbeRoute;
+    exports.ADAPTIVE_PROBE_BYTES = 128 * 1024;
+    var BODY = Buffer.alloc(exports.ADAPTIVE_PROBE_BYTES, 97);
+    function registerAdaptiveProbeRoute(fastify) {
+      fastify.get("/adaptive-probe", async (_req, reply) => {
+        reply.header("cache-control", "no-store");
+        reply.header("content-type", "application/octet-stream");
+        return reply.send(BODY);
+      });
+    }
+  }
+});
+
 // ../../server/backend/dist/api/model-distributor.js
 var require_model_distributor = __commonJS({
   "../../server/backend/dist/api/model-distributor.js"(exports) {
@@ -402068,19 +403700,8 @@ var require_trpc_router = __commonJS({
       const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
       return { ...input, relayOnly };
     }
-    var REMOTE_INITIAL_ADAPTIVE_TIER = "low";
-    function enrichHintsWithClientClass(input, clientClass) {
-      if (clientClass !== "remote")
-        return input;
-      const isAdaptive = input.target === void 0 || input.target.kind === "adaptive";
-      if (!isAdaptive)
-        return input;
-      if (input.hints?.prefersTier !== void 0)
-        return input;
-      return {
-        ...input,
-        hints: { ...input.hints, prefersTier: REMOTE_INITIAL_ADAPTIVE_TIER }
-      };
+    function enrichHintsWithClientClass(input, _clientClass) {
+      return input;
     }
     function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
       const userAgent = (0, client_ip_js_1.extractUserAgent)(ctx.req);
@@ -402418,7 +404039,8 @@ var require_boot_config = __commonJS({
           const pair = loadTlsCert(config.tls.certPath, config.tls.keyPath);
           tlsOptions = { key: pair.key, cert: pair.cert };
         } else {
-          const tlsResult = await ensureTlsCert(dataPath);
+          const extraSans = [...core.readExtraSans?.(dataPath) ?? []];
+          const tlsResult = await ensureTlsCert(dataPath, extraSans.length > 0 ? { extraSans } : void 0);
           tlsCert = tlsResult;
           logTlsCert(tlsResult);
           const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
@@ -403509,90 +405131,127 @@ var require_addon_registry_service = __commonJS({
           return entry?.packageName === "@camstack/system" && entry.declaration !== void 0 && (0, types_1.isIsolatedBuiltin)(entry.declaration);
         });
         const isolatedBuiltins = new Set(isolatedBuiltinIds);
-        await spawnRunnerPlan(this.buildAddonGroupPlan(allIds.filter((id) => !isolatedBuiltins.has(id))));
+        const { infra: isolatedInfraIds, consumers: isolatedConsumerIds } = (0, system_1.partitionIsolatedBuiltinIds)(isolatedBuiltinIds, (id) => {
+          const entry = this.addonEntries.get(id);
+          return entry?.declaredCapabilities ?? [];
+        });
         const isCoreBuiltin = (id) => this.addonEntries.get(id)?.packageName === "@camstack/system" && !isolatedBuiltins.has(id);
-        for (const infra of system_1.INFRA_CAPABILITIES) {
-          const addonId = this.findAddonForCapability(infra.name, allIds);
-          if (addonId) {
-            const entry = this.addonEntries.get(addonId);
-            if (!entry || entry.initialized || !isCoreBuiltin(addonId))
-              continue;
+        await (0, system_1.runHubAddonBoot)({
+          spawnIsolatedInfra: async () => {
+            if (isolatedInfraIds.length === 0)
+              return;
+            this.logger.info("Spawning isolated infrastructure builtins", {
+              meta: { addonIds: isolatedInfraIds }
+            });
+            await spawnRunnerPlan(this.buildAddonGroupPlan(isolatedInfraIds));
+          },
+          waitForDataStoreProvider: async () => {
+            if (isolatedInfraIds.length === 0)
+              return;
             try {
-              await this.initializeAddon(addonId);
-              this.wireCapabilities(addonId);
-            } catch (error) {
-              const msg = (0, types_1.errMsg)(error);
-              this.emitAddonLifecycleEvent("addon.error", addonId, {
-                error: msg,
-                phase: "init"
+              await (0, system_1.waitUntilReady)(() => this.capabilityRegistry.getCollection("data-store-provider").length > 0, {
+                timeoutMs: 3e4,
+                intervalMs: 50,
+                what: "isolated data-store-provider engine"
               });
-              if (infra.required) {
-                throw new Error(`Required infrastructure addon "${addonId}" failed: ${msg}`, {
-                  cause: error
-                });
-              }
-              this.logger.warn("Optional infra addon failed -- continuing", {
-                tags: { addonId },
-                meta: { error: msg }
+            } catch (err) {
+              this.logger.error("Isolated data-store-provider engine did not register in time", {
+                meta: { error: (0, types_1.errMsg)(err), addonIds: isolatedInfraIds }
               });
             }
-          } else if (infra.required) {
-            throw new Error(`No addon provides required infrastructure capability "${infra.name}"`);
-          }
-        }
-        const bootOrder = this.capabilityRegistry.getBootOrder();
-        const infraNames = new Set(system_1.INFRA_CAPABILITIES.map((c) => c.name));
-        for (const capName of bootOrder) {
-          if (infraNames.has(capName))
-            continue;
-          for (const id of allIds) {
-            const entry = this.addonEntries.get(id);
-            if (!entry || entry.initialized || !isCoreBuiltin(id))
-              continue;
-            const provides = this.getAddonCapabilities(entry.addon);
-            if (!provides.some((c) => c.name === capName))
-              continue;
-            try {
-              await this.initializeAddon(id);
-              this.wireCapabilities(id);
-            } catch (error) {
-              const msg = (0, types_1.errMsg)(error);
-              this.emitAddonLifecycleEvent("addon.error", id, {
-                error: msg,
-                phase: "init"
-              });
-              this.logger.error("Core builtin failed to initialize -- skipping", {
-                tags: { addonId: id },
-                meta: { error: msg }
-              });
+          },
+          bootInProcessInfra: async () => {
+            for (const infra of system_1.INFRA_CAPABILITIES) {
+              const addonId = this.findAddonForCapability(infra.name, allIds);
+              if (addonId) {
+                const entry = this.addonEntries.get(addonId);
+                if (!entry || entry.initialized || !isCoreBuiltin(addonId))
+                  continue;
+                try {
+                  await this.initializeAddon(addonId);
+                  this.wireCapabilities(addonId);
+                } catch (error) {
+                  const msg = (0, types_1.errMsg)(error);
+                  this.emitAddonLifecycleEvent("addon.error", addonId, {
+                    error: msg,
+                    phase: "init"
+                  });
+                  if (infra.required) {
+                    throw new Error(`Required infrastructure addon "${addonId}" failed: ${msg}`, {
+                      cause: error
+                    });
+                  }
+                  this.logger.warn("Optional infra addon failed -- continuing", {
+                    tags: { addonId },
+                    meta: { error: msg }
+                  });
+                }
+              } else if (infra.required) {
+                throw new Error(`No addon provides required infrastructure capability "${infra.name}"`);
+              }
             }
-          }
-        }
-        for (const id of allIds) {
-          const entry = this.addonEntries.get(id);
-          if (entry && !entry.initialized && isCoreBuiltin(id)) {
-            try {
-              await this.initializeAddon(id);
-              this.wireCapabilities(id);
-            } catch (error) {
-              const msg = (0, types_1.errMsg)(error);
-              this.emitAddonLifecycleEvent("addon.error", id, {
-                error: msg,
-                phase: "init"
-              });
-              this.logger.error("Core builtin failed to initialize -- skipping", {
-                tags: { addonId: id },
-                meta: { error: msg }
-              });
+          },
+          spawnForkedAddons: async () => {
+            await spawnRunnerPlan(this.buildAddonGroupPlan(allIds.filter((id) => !isolatedBuiltins.has(id))));
+          },
+          bootInProcessConsumers: async () => {
+            const bootOrder = this.capabilityRegistry.getBootOrder();
+            const infraNames = new Set(system_1.INFRA_CAPABILITIES.map((c) => c.name));
+            for (const capName of bootOrder) {
+              if (infraNames.has(capName))
+                continue;
+              for (const id of allIds) {
+                const entry = this.addonEntries.get(id);
+                if (!entry || entry.initialized || !isCoreBuiltin(id))
+                  continue;
+                const provides = this.getAddonCapabilities(entry.addon);
+                if (!provides.some((c) => c.name === capName))
+                  continue;
+                try {
+                  await this.initializeAddon(id);
+                  this.wireCapabilities(id);
+                } catch (error) {
+                  const msg = (0, types_1.errMsg)(error);
+                  this.emitAddonLifecycleEvent("addon.error", id, {
+                    error: msg,
+                    phase: "init"
+                  });
+                  this.logger.error("Core builtin failed to initialize -- skipping", {
+                    tags: { addonId: id },
+                    meta: { error: msg }
+                  });
+                }
+              }
+            }
+            for (const id of allIds) {
+              const entry = this.addonEntries.get(id);
+              if (entry && !entry.initialized && isCoreBuiltin(id)) {
+                try {
+                  await this.initializeAddon(id);
+                  this.wireCapabilities(id);
+                } catch (error) {
+                  const msg = (0, types_1.errMsg)(error);
+                  this.emitAddonLifecycleEvent("addon.error", id, {
+                    error: msg,
+                    phase: "init"
+                  });
+                  this.logger.error("Core builtin failed to initialize -- skipping", {
+                    tags: { addonId: id },
+                    meta: { error: msg }
+                  });
+                }
+              }
             }
+          },
+          spawnIsolatedConsumers: async () => {
+            if (isolatedConsumerIds.length === 0)
+              return;
+            this.logger.info("Spawning isolated system builtins", {
+              meta: { addonIds: isolatedConsumerIds }
+            });
+            await spawnRunnerPlan(this.buildAddonGroupPlan(isolatedConsumerIds));
           }
-        }
-        if (isolatedBuiltinIds.length > 0) {
-          this.logger.info("Spawning isolated system builtins", {
-            meta: { addonIds: isolatedBuiltinIds }
-          });
-          await spawnRunnerPlan(this.buildAddonGroupPlan(isolatedBuiltinIds));
-        }
+        });
         const initializedIds = [...this.addonEntries.entries()].filter(([, e]) => e.initialized).map(([id]) => id);
         this.logger.info("Addons initialized", {
           meta: { initializedCount: initializedIds.length, totalCount: this.addonEntries.size }
@@ -404855,12 +406514,13 @@ var require_addon_registry_service = __commonJS({
               if (syncStore) {
                 this.configService.setSettingsStore(syncStore);
               } else {
-                this.logger.error("settings-store provider does not implement the sync ConfigManager surface and no data-store-provider engine does either \u2014 every addon store reads empty, devices will NOT be restored", { meta: { addonId, phase: "v2" } });
+                this.logger.info("settings-store engine is isolated \u2014 ConfigManager uses the async door, not a sync ISettingsStore", { meta: { addonId, phase: "v2" } });
               }
               this.storageService.setSettingsBackend(provider);
               const store = this.capabilityRegistry.getProviderByAddon("settings-store", addonId);
               if (!store)
                 return;
+              this.configService.setSettingsDoor(store);
               this.integrationRegistry = new system_1.IntegrationRegistry(store);
               void this.integrationRegistry.initialize().then(() => {
                 this.logger.info("IntegrationRegistry initialized", { meta: { phase: "v2" } });
@@ -407334,15 +408994,15 @@ var require_moleculer_service = __commonJS({
   "../../server/backend/dist/core/moleculer/moleculer.service.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MoleculerService = void 0;
+    exports.ChildManifestGate = exports.CHILD_MANIFEST_SKIP_SAMPLE = exports.MoleculerService = void 0;
     exports.childOwnerToken = childOwnerToken;
     exports.buildChildUdsManifest = buildChildUdsManifest;
     var node_crypto_1 = __require("crypto");
     var system_1 = require_dist3();
     var types_1 = require_dist9();
-    var agent_readiness_pull_js_1 = require_agent_readiness_pull();
     var cap_router_runtime_js_1 = require_cap_router_runtime();
     var core_cap_bridge_js_1 = require_core_cap_bridge();
+    var agent_readiness_pull_js_1 = require_agent_readiness_pull();
     var cap_call_fn_js_1 = require_cap_call_fn();
     var cap_route_authority_js_1 = require_cap_route_authority();
     var MoleculerService = class _MoleculerService {
@@ -407377,6 +409037,12 @@ var require_moleculer_service = __commonJS({
        * See `docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md`.
        */
       nodeOwners = /* @__PURE__ */ new Map();
+      /**
+       * Skips the manifest rebuild for a child re-register that carries nothing new
+       * — 246 of them in 30 minutes with zero respawns, measured live 2026-08-25.
+       * See {@link ChildManifestGate}.
+       */
+      childManifestGate = new ChildManifestGate();
       /**
        * Fixed-period agent-readiness snapshot sweep (D8 reconcile) — repairs
        * agent-origin readiness deltas lost while the agent stayed connected.
@@ -407698,6 +409364,19 @@ var require_moleculer_service = __commonJS({
             const hubNodeId = this.brokerSafe.nodeID;
             const childNodeId = `${hubNodeId}/${child.childId}`;
             const params = buildChildUdsManifest(childNodeId, child.childId, child.caps);
+            if (!this.childManifestGate.shouldApply(child.childId, child.incarnation, params)) {
+              if (this.childManifestGate.sampleDue()) {
+                logger.debug("UDS child re-registered with an unchanged manifest \u2014 skipped", {
+                  meta: {
+                    nodeId: childNodeId,
+                    incarnation: child.incarnation,
+                    skipped: this.childManifestGate.skippedSince(),
+                    sampleEvery: exports.CHILD_MANIFEST_SKIP_SAMPLE
+                  }
+                });
+              }
+              return;
+            }
             this.onRegisterNode(params, childOwnerToken(childNodeId, child.incarnation));
             logger.info("UDS child registered \u2014 manifest applied", {
               meta: { nodeId: childNodeId, incarnation: child.incarnation }
@@ -407706,6 +409385,7 @@ var require_moleculer_service = __commonJS({
           registry.onChildGone((childId, incarnation) => {
             const hubNodeId = this.brokerSafe.nodeID;
             const childNodeId = `${hubNodeId}/${childId}`;
+            this.childManifestGate.forget(childId);
             logger.info("UDS child gone \u2014 removing from registry", {
               meta: { childId, incarnation }
             });
@@ -407940,12 +409620,13 @@ var require_moleculer_service = __commonJS({
         if (!registry)
           return;
         const registryKeyFor = (addonId) => isLocalChild ? addonId : `${addonId}@${nodeId}`;
+        const skipInfraFromRemote = (capName) => (0, system_1.isInfraCapability)(capName) && !isLocalChild;
         const appliedKeys = (manifest) => {
           const keys = /* @__PURE__ */ new Map();
           for (const addon of manifest) {
             const registryKey = registryKeyFor(addon.addonId);
             for (const capName of addon.capabilities) {
-              if ((0, system_1.isInfraCapability)(capName))
+              if (skipInfraFromRemote(capName))
                 continue;
               const capDef = registry.getDefinition(capName);
               if (!capDef)
@@ -408236,6 +409917,48 @@ var require_moleculer_service = __commonJS({
     function childOwnerToken(childNodeId, incarnation) {
       return `${childNodeId}#${incarnation}`;
     }
+    exports.CHILD_MANIFEST_SKIP_SAMPLE = 25;
+    function childManifestFingerprint(params) {
+      const addons = params.addons.map((addon) => `${addon.addonId}:${[...addon.capabilities].sort().join(",")}`).sort();
+      return `${params.nodeId}|${addons.join("|")}`;
+    }
+    var ChildManifestGate = class {
+      applied = /* @__PURE__ */ new Map();
+      skipped = 0;
+      sinceSample = 0;
+      /** True when this registration carries something the registry does not have. */
+      shouldApply(childId, incarnation, params) {
+        const fingerprint = childManifestFingerprint(params);
+        const previous = this.applied.get(childId);
+        if (previous !== void 0 && previous.incarnation === incarnation) {
+          if (previous.fingerprint === fingerprint) {
+            this.skipped += 1;
+            this.sinceSample += 1;
+            return false;
+          }
+        }
+        this.applied.set(childId, { incarnation, fingerprint });
+        return true;
+      }
+      /** Drop a child's record — its next register is a first register again. */
+      forget(childId) {
+        this.applied.delete(childId);
+      }
+      /** How many have been skipped since the last call. Reading RESETS it. */
+      skippedSince() {
+        const n = this.skipped;
+        this.skipped = 0;
+        return n;
+      }
+      /** True once every {@link CHILD_MANIFEST_SKIP_SAMPLE} skips. */
+      sampleDue() {
+        if (this.sinceSample < exports.CHILD_MANIFEST_SKIP_SAMPLE)
+          return false;
+        this.sinceSample = 0;
+        return true;
+      }
+    };
+    exports.ChildManifestGate = ChildManifestGate;
     function buildChildUdsManifest(nodeId, childId, caps) {
       const capsByAddon = /* @__PURE__ */ new Map();
       for (const cap of caps) {
@@ -409742,7 +411465,13 @@ var require_manual_boot = __commonJS({
           });
         },
         async listen(port, host) {
-          await fastify.listen({ port, host });
+          await fastify.listen({
+            port,
+            host,
+            // Dual-stack when binding `::`. Positional listen() drops this and
+            // on macOS/BSD `IPV6_V6ONLY` defaults to 1 — IPv4 clients die.
+            ipv6Only: host === "::" ? false : void 0
+          });
         },
         close
       };
@@ -409807,6 +411536,7 @@ var require_main4 = __commonJS({
     var addon_upload_1 = require_addon_upload();
     var auth_whoami_1 = require_auth_whoami();
     var health_routes_1 = require_health_routes();
+    var adaptive_probe_routes_1 = require_adaptive_probe_routes();
     var model_distributor_js_1 = require_model_distributor();
     var oauth2_routes_js_1 = require_oauth2_routes();
     var server_upload_1 = require_server_upload();
@@ -410044,6 +411774,7 @@ var require_main4 = __commonJS({
           verifyToken: (token2) => app.get(auth_service_1.AuthService).verifyToken(token2)
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
+        (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify);
       } catch (err) {
         console.warn("[bootstrap] Failed to register health routes:", err);
       }
@@ -410281,12 +412012,12 @@ var require_main4 = __commonJS({
           } catch {
             return reply.status(401).send({ error: "invalid token" });
           }
-          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec);
+          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec, { secure: request.protocol === "https" });
           reply.setCookie(c.name, c.value, c.options);
           return reply.send({ ok: true });
         });
-        fastify.delete("/api/auth/session", async (_request, reply) => {
-          const c = (0, session_cookie_js_1.clearSessionCookie)();
+        fastify.delete("/api/auth/session", async (request, reply) => {
+          const c = (0, session_cookie_js_1.clearSessionCookie)({ secure: request.protocol === "https" });
           reply.setCookie(c.name, c.value, c.options);
           return reply.send({ ok: true });
         });
@@ -410306,7 +412037,7 @@ var require_main4 = __commonJS({
           } catch {
             return reply.status(401).send({ error: "invalid token" });
           }
-          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec);
+          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec, { secure: request.protocol === "https" });
           reply.setCookie(c.name, c.value, c.options);
           return reply.redirect(next);
         });
@@ -410571,7 +412302,7 @@ var require_main4 = __commonJS({
         const url = request.url;
         if ((0, spa_static_1.isRetiredPublicPath)(url))
           return reply.callNotFound();
-        if (url.startsWith("/trpc") || url.startsWith("/api/") || url.startsWith("/agent") || url.startsWith("/health") || url.startsWith("/viewer")) {
+        if (url.startsWith("/trpc") || url.startsWith("/api/") || url.startsWith("/agent") || url.startsWith("/health") || url.startsWith("/adaptive-probe") || url.startsWith("/viewer")) {
           return reply.callNotFound();
         }
         const { staticDir, indexPath } = adminUiState;
@@ -410661,7 +412392,16 @@ var require_main4 = __commonJS({
         }
       };
       try {
-        await app.listen(port, host);
+        const listenHost = (0, system_1.allFamiliesListenHost)(host).host;
+        try {
+          await app.listen(port, listenHost);
+        } catch (listenErr) {
+          if (listenHost === "::" && host !== "::") {
+            await app.listen(port, "0.0.0.0");
+          } else {
+            throw listenErr;
+          }
+        }
       } catch (listenErr) {
         if (listenErr !== null && typeof listenErr === "object" && "code" in listenErr && listenErr.code === "EADDRINUSE") {
           console.error(`[bootstrap] FATAL: Port ${port} is already in use. Stop the other process or change server.port in config.yaml.`);
@@ -410672,6 +412412,26 @@ var require_main4 = __commonJS({
       const logger = app.get(logging_service_1.LoggingService).createLogger("System");
       const protocol = tlsOptions ? "https" : "http";
       logger.info("CamStack server listening", { meta: { protocol, host, port, trpcRegistered } });
+      (0, system_1.registerLanHttpHandler)({
+        onRequest: (req, res) => {
+          fastify.server.emit("request", req, res);
+        },
+        onUpgrade: (req, socket, head) => {
+          fastify.server.emit("upgrade", req, socket, head);
+        }
+      });
+      try {
+        const lanHttp = await (0, system_1.bindPendingLanHttp)();
+        if (lanHttp.listening) {
+          logger.info("LAN HTTP listening", { meta: { port: lanHttp.port } });
+        } else if (lanHttp.error) {
+          logger.warn("LAN HTTP not bound", { meta: { error: lanHttp.error, port: lanHttp.port } });
+        }
+      } catch (err) {
+        logger.warn("LAN HTTP bind failed", {
+          meta: { error: err instanceof Error ? err.message : String(err) }
+        });
+      }
       void Promise.all([resolveAdminUi(), resolveViewerUi()]);
       const postBoot = app.get(post_boot_service_1.PostBootService);
       await postBoot.run({ port, host, dataPath, trpcRegistered, tlsCert });